CVE-2019-10218

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.

• CWE-22
• CWE-22

• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10218Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMIYCYXCPRTVCVZ3TP6ZGPJ6RZS3IX4G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/
• https://www.samba.org/samba/security/CVE-2019-10218.htmlVendor Advisory
• https://www.synology.com/security/advisory/Synology_SA_19_35
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00015.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10218Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/05/msg00023.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OKPYHDFI7HRELVXBE5J4MTGSI35AKFBI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMIYCYXCPRTVCVZ3TP6ZGPJ6RZS3IX4G/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3IUACPZJXSC4OM6P2V4IC4QMZQZWPD/
• https://www.samba.org/samba/security/CVE-2019-10218.htmlVendor Advisory
• https://www.synology.com/security/advisory/Synology_SA_19_35

Published

Nov 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10212A flaw was found in, all under 2.0.20, in the Undertow DEBUG…9.8
• CVE-2019-10213OpenShift Container Platform, versions 4.1 and 4.2, does not…6.5
• CVE-2019-10214The containers/image library used by the container tools Pod…5.9
• CVE-2019-10215Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a…6.1
• CVE-2019-10216In ghostscript before version 9.50, the .buildfont1 procedur…7.8
• CVE-2019-10217A flaw was found in ansible 2.8.0 before 2.8.4. Fields manag…6.5
• CVE-2019-10219A vulnerability was found in Hibernate-Validator. The SafeHt…6.1
• CVE-2019-1022An elevation of privilege exists in Windows Audio Service. A…7.8
• CVE-2019-10220Linux kernel CIFS implementation, version 4.9.0 is vulnerabl…8.8
• CVE-2019-10221A Reflected Cross Site Scripting vulnerability was found in …6.1
• CVE-2019-10222A flaw was found in the Ceph RGW configuration with Beast as…7.5
• CVE-2019-10223A security issue was discovered in the kube-state-metrics ve…6.5