CVE-2018-18586

chmextract.c in the chmextract sample program, as distributed with libmspack before 0.8alpha, does not protect against absolute/relative pathnames in CHM files, leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability, because chmextract.c was only intended as a source-code example, not a supported application

• CWE-22

• https://bugs.debian.org/911639Mailing List, Third Party Advisory
• https://github.com/kyz/libmspack/commit/7cadd489698be117c47efcadd742651594429e6dExploit, Vendor Advisory
• https://security.gentoo.org/glsa/201903-20Third Party Advisory
• https://www.openwall.com/lists/oss-security/2018/10/22/1Mailing List, Third Party Advisory
• https://bugs.debian.org/911639Mailing List, Third Party Advisory
• https://github.com/kyz/libmspack/commit/7cadd489698be117c47efcadd742651594429e6dExploit, Vendor Advisory
• https://security.gentoo.org/glsa/201903-20Third Party Advisory
• https://www.openwall.com/lists/oss-security/2018/10/22/1Mailing List, Third Party Advisory

Published

Oct 23, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1858IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cro…8.8
• CVE-2018-18581An issue has been found in LuPng through 2017-03-10. It is a…
• CVE-2018-18582An issue has been found in LuPng through 2017-03-10. It is a…
• CVE-2018-18583An issue has been found in LuPng through 2017-03-10. It is a…
• CVE-2018-18584In mspack/cab.h in libmspack before 0.8alpha and cabextract …6.5
• CVE-2018-18585chmd_read_headers in mspack/chmd.c in libmspack before 0.8al…4.3
• CVE-2018-18587BigProf AppGini 5.70 stores the passwords in the database us…
• CVE-2018-18589A potential Remote Arbitrary Code Execution vulnerability ha…6.3
• CVE-2018-1859IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user a…4.3
• CVE-2018-18590A potential remote code execution and information disclosure…9.6
• CVE-2018-18591A potential unauthorized disclosure of data vulnerability ha…6.8
• CVE-2018-18593Remote Directory Traversal and Remote Disclosure of Privileg…6.5