{"id":"CVE-2015-1194","title":"pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.","published":"2015-01-21T14:59:55.357Z","updated":"2026-06-16T20:21:55.833Z","severity":"medium","cvssScore":4.3,"epss":0.01695,"epssPct":0.77476,"kev":false,"maturity":"none","actionScore":18,"primaryVendor":"pax project","primaryProduct":"pax","cweId":"CWE-59","fixAvailable":true,"tags":["pre-auth","remote"],"epssDelta7":0,"summary":"pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.","cvssVector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","cvssVersion":"2.0","cvssSource":"nvd-primary","cweName":"Improper Link Resolution Before File Access ('Link Following')","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-06T04:33:20.746Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:48:07.828Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"pax project","product":"pax","cpe":"cpe:2.3:a:pax_project:pax"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2015/01/18/3","tags":null}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"pax project","product":"pax","version":"1:20140703","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}