CLSA-2026-1788193166
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1788193166.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1788193166
- Upstream
- CVE-2026-6475
- Published
- 2026-08-31T16:19:38Z
- Modified
- 2026-10-26T09:31:53Z
- Summary
- Fix CVE(s): CVE-2026-6475
- Details
-
- SECURITY UPDATE: Path traversal in pg_rewind: file, directory and
symlink paths received from the source server over libpq were acted on
without validation, so a rogue origin could make pg_rewind write,
truncate or unlink files outside the target data directory
- debian/patches/CVE-2026-6475.patch: Add path_is_safe_for_extraction() in src/port/path.c, which canonicalises a path and requires it to stay relative and below the current directory, and gate every pg_rewind target file/dir/symlink operation on it with pg_fatal() (upstream commit 498829dca4; the pg_basebackup astreamer half of that commit is v15+ and absent from 9.6)
- CVE-2026-6475: path traversal in pg_rewind target file operations via unvalidated paths supplied by the source server
- SECURITY UPDATE: Path traversal in pg_rewind: file, directory and
symlink paths received from the source server over libpq were acted on
without validation, so a rogue origin could make pg_rewind write,
truncate or unlink files outside the target data directory
- References