Description
The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | wesnoth-1.8 | 1:1.8.5-1+deb6u2 | DLA-297-1 |
Advisories 1
- DLA-297-1 wesnoth-1.8 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://github.com/wesnoth/wesnoth/releases/tag/1.13.1
- FEDORA-2015-10964 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1236010
- https://github.com/wesnoth/wesnoth/commit/f8914468182e8d0a1551b430c0879ba236fe4d6d
- FEDORA-2015-10973 vendor-advisory
- https://gna.org/bugs/?23504
- 75424 vdb-entry
- [oss-security] 20150625 Re: CVE request: Wesnoth authentication information disclosure mailing-list
- https://github.com/wesnoth/wesnoth/releases/tag/1.12.3