Description
Directory traversal vulnerability in the WML engine preprocessor for Wesnoth 1.2.x before 1.2.8, and 1.3.x before 1.3.12, allows remote attackers to read arbitrary files via ".." sequences in unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | wesnoth | 1:1.2.7-2+lenny1 | DTSA-90-1 |
| Debian 4.0 | wesnoth | 1.2-3 | DSA-1421-1 |
| Debian 3.1 | wesnoth | 0.9.0-7 | DSA-1421-1 |
Advisories 2
- DSA-1421-1 wesnoth - directory traversal Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-90-1 wesnoth - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026
References
- 41713 vdb-entry
- 27920 third-party-advisory
- FEDORA-2007-3989 vendor-advisory
- http://sourceforge.net/project/shownotes.php?release_id=557098
- 27943 third-party-advisory
- 27786 third-party-advisory
- http://www.wesnoth.org/forum/viewtopic.php?p=264289#264289
- FEDORA-2007-3986 vendor-advisory
- ADV-2007-4026 vdb-entry
- http://www.wesnoth.org/forum/viewtopic.php?t=18844
- wesnoth-wml-directory-traversal(38752) vdb-entry
- 26626 vdb-entry
- DSA-1421 vendor-advisory