Servers and applications
CVE-2015-5252
vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relationships exist, allows remote attackers to bypass intended file-access restrictions via a symlink that points outside of a share.
- Severity
- High 7.2
- Published
- 29 Dec 2015
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 4.1.22, 4.2.7, 4.3.3
- Exploit chance
- 13% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- CWE-264
- Attack
- Over the network · No login needed · No user action needed
- Attacker can
- Read some data · Change some data
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
SambaServers and applications · cpe:a:samba:samba |
|