CVE-2026-91094: Debian/dpkg vulnerability

Q: Who is exposed to this issue?

Systems that unpack 3.0 (quilt) source packages are exposed when processing a packaging tarball that includes an attacker-controlled .pc quilt database directory.

Q: What does an attacker need for exploitation?

The attacker needs to supply a packaging tarball containing attacker-controlled symlinks in .pc and patches that fail to apply. During restoration of backup files, the affected code can then modify or remove files targeted by those symlinks.

Published Nov 13, 2026

Updated

A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.

Affected Software

4 affected componentsFixes available

debian/dpkg*

debian/dpkg<=1.21.23, <=1.22.22, <=1.23.11

1.23.12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/dpkg to a version that resolves this vulnerability.
Fixed in 1.23.12

Event History

Nov 13, 2026

CVE Published

via MITRE·02:01 PM

Data Sourced

via MITRE·02:01 PM

Description

Data Sourced

via NVD·02:18 PM

Description

Data Sourced

via OSV·03:47 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems that unpack 3.0 (quilt) source packages are exposed when processing a packaging tarball that includes an attacker-controlled .pc quilt database directory.

What does an attacker need for exploitation?

The attacker needs to supply a packaging tarball containing attacker-controlled symlinks in .pc and patches that fail to apply. During restoration of backup files, the affected code can then modify or remove files targeted by those symlinks.

CVE-2026-91094: Debian/dpkg vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need for exploitation?