Skip to content
Fencer Vulns
medium 5.5

CVE-2018-1000801 json

okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cp…

published 2018-09-06 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2005

cvss
5.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

okular version 18.08 and earlier contains a Directory Traversal vulnerability in function "unpackDocumentArchive(...)" in "core/document.cpp" that can result in Arbitrary file creation on the user workstation. This attack appear to be exploitable via he victim must open a specially crafted Okular archive. This issue appears to have been corrected in version 18.08.1

Patch / fix

  • okular Debian 14, Debian 13, Debian 12 4:17.12.2-2.1

debian advisories DEBIAN-CVE-2018-1000801

  • okular Ubuntu Pro 18.04 LTS 4:17.12.3-0ubuntu1+esm1

ubuntu advisories UBUNTU-CVE-2018-1000801

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • okular RHEL 7 4.10.5-8.el7
  • okular-libs RHEL 7 4.10.5-8.el7
  • okular-part RHEL 7 4.10.5-8.el7

red hat advisories RHSA-2020:1173

  • okular openSUSE Tumbleweed 21.08.1-1.2

opensuse advisories openSUSE-SU-2024:11110-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000801 updated cvss 5.5

okular: Directory traversal in function unpackDocumentArchive() in core/document.cpp

  • Red Hat Enterprise Linux Client (v. 7) okular 4.10.5-8.el7, okular-libs 4.10.5-8.el7, okular-part 4.10.5-8.el7 Red Hat Enterprise Linux Client Optional (v. 7) okular-devel 4.10.5-8.el7, okular-debuginfo 4.10.5-8.el7 Red Hat Enterprise Linux Server (v. 7) okular 4.10.5-8.el7, okular-libs 4.10.5-8.el7, okular-part 4.10.5-8.el7 Red Hat Enterprise Linux Workstation (v. 7) okular 4.10.5-8.el7, okular-libs 4.10.5-8.el7, okular-part 4.10.5-8.el7
    fixed: vendor fix “Check Okular archives with `unzip -l <archive-name>.okular` before opening them. Do not open them with Okular if they contain files with "../".” RHSA-2020:1173

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.85% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.kde.org https://bugs.kde.org/show_bug.cgi?id=398096 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.