CVE-2015-8768

Critical

Published: 13/02/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The click/install.py file in the click library does not require files in package filesystem tarballs to start with './', allowing remote attackers to install an alternate security policy and gain privileges via a crafted package.

Risk Assessment

Attackers can exploit this vulnerability to gain unauthorized access to the system, potentially leading to serious security breaches within the organization.

Recommendation

It is recommended to update the click library to the latest version that fixes this vulnerability and review the security policy of applications using this library.

Original NVD description (English source)

click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which allows remote attackers to install an alternate security policy and gain privileges via a crafted package, as demonstrated by the test.mmrow app for Ubuntu phone.