$ cve CVE-2010-0926 JSON

CVE-2010-0926 EXPLOIT

3.5

LOW · CVSS 2.0 · EPSS 30.4% (pctl 98)

Patch early

A public exploit exists.

Description

The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.

Scoring

CVSS	3.5 (LOW, v2.0)
Vector	AV:N/AC:M/Au:S/C:P/I:N/A:N
EPSS	30.43% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-22
On CISA KEV	no
Public exploit	yes
Published	2010-03-10
Last modified	2026-06-16

Affected (1)

Vendor	Product
samba	samba

Public exploits

Source	Title	Date
exploit-db	Samba 3.4.5 - Symlink Directory Traversal (Metasploit)	2010-02-04
exploit-db	Samba 3.4.5 - Symlink Directory Traversal	2010-02-04

References

→ the Explorer · watch your stack · NVD