Description
SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql client can be used for CALL SNIPPETS and load_file operations on a full pathname (e.g., a file in the /etc directory). NOTE: this is unrelated to CMUSphinx.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sphinxsearch | 2.2.11-3 | — |
| Debian 13 | sphinxsearch | 2.2.11-3 | — |
| Debian 12 | sphinxsearch | 2.2.11-3 | — |
| Debian 10 | sphinxsearch | 2.2.11-2+deb10u1 | DSA-5036-1 |
| Debian 9 | sphinxsearch | 2.2.11-1.1+deb9u1 | DLA-2882-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | sphinxsearch | No fix yet | — |
| Ubuntu 20.04 LTS | sphinxsearch | No fix yet | — |
| Ubuntu 18.04 LTS | sphinxsearch | No fix yet | — |
| Ubuntu 16.04 LTS | sphinxsearch | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.4 | sphinx | 2.2.11-lp154.3.3.1 | openSUSE-SU-2022:0046-1 |
| openSUSE Leap 15.3 | sphinx | 2.2.11-lp153.2.3.1 | openSUSE-SU-2022:0054-1 |
Advisories 4
- DSA-5036-1 sphinxsearch - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2882-1 sphinxsearch - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2022:0046-1 Security update for sphinx SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2022:0054-1 Security update for sphinx SUSE / openSUSE Security Updates · Feb 4, 2026