ALPINE-CVE-2026-104715

Source
https://security.alpinelinux.org/vuln/CVE-2026-104715
Import Source
https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-104715.json
JSON Data
https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-104715
Upstream
  • CVE-2026-104715
Published
2026-10-16T07:17:08Z
Modified
2026-10-23T18:30:02Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.

References

Affected packages

Alpine:v3.21 / cifs-utils

Package

Name
cifs-utils
Purl
pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.1-r1

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-104715.json"

Alpine:v3.22 / cifs-utils

Package

Name
cifs-utils
Purl
pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.3-r1

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-104715.json"

Alpine:v3.23 / cifs-utils

Package

Name
cifs-utils
Purl
pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.4-r1

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-104715.json"

Alpine:v3.24 / cifs-utils

Package

Name
cifs-utils
Purl
pkg:apk/alpine/cifs-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
7.5-r1

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-104715.json"