CVE-2010-0926Samba Path Traversal
The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in…
Published Mar 10, 2010 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2010-0926
Key Facts
Routine patching- CVE-2010-0926 is a low-severity vulnerability (CVSS 3.5 v2) affecting Samba, rootio-samba, libsmbclient-devel (oracle) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 30% probability of exploitation in the next 30 days.
- Fixed versions are available, including ctdb 4.5.0-1.1, ctdb-pcp-pmda 4.5.0-1.1, ctdb-tests 4.5.0-1.1.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Scores
CVSS v2
3.5
AV:N/AC:M/Au:S/C:P/I:N/A:N
EPSS (30-day exploit likelihood)
30%
Higher than 98.2% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
37/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
2
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing .. (dot dot) sequences, related to the combination of the unix extensions and wide links options.
Affected Products
112 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SambaSamba | 3.3.0, 3.3.1, 3.3.10, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6 | 2:3.4.6~dfsg-1 |
| rootio-sambarootio | See advisory | 2:3.4.6~dfsg-1 |
| libsmbclient-develoracle | See advisory | 3.0.33-3.37.el5 |
| libsmbclientoracle | See advisory | 3.0.33-3.37.el5 |
| samba-clientoracle | See advisory | 3.0.33-3.37.el5 |
Patched Releases
ctdb
4.5.0-1.1
ctdb-pcp-pmda
4.5.0-1.1
ctdb-tests
4.5.0-1.1
libdcerpc-binding0
4.5.0-1.1
libdcerpc-binding0-32bit
4.5.0-1.1
libdcerpc-devel
4.5.0-1.1
libdcerpc-samr-devel
4.5.0-1.1
libdcerpc-samr0
4.5.0-1.1
libdcerpc-samr0-32bit
4.5.0-1.1
libdcerpc0
4.5.0-1.1
libdcerpc0-32bit
4.5.0-1.1
libndr-devel
4.5.0-1.1
libndr-krb5pac-devel
4.5.0-1.1
libndr-krb5pac0
4.5.0-1.1
libndr-krb5pac0-32bit
4.5.0-1.1
libndr-nbt-devel
4.5.0-1.1
libndr-nbt0
4.5.0-1.1
libndr-nbt0-32bit
4.5.0-1.1
libndr-standard-devel
4.5.0-1.1
libndr-standard0
4.5.0-1.1
libndr-standard0-32bit
4.5.0-1.1
libndr0
4.5.0-1.1
libndr0-32bit
4.5.0-1.1
libnetapi-devel
4.5.0-1.1
libnetapi0
4.5.0-1.1
Timeline
Publicly disclosed
Mar 10, 2010
Last updated
Aug 4, 2026
Weakness Type
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- advisorysecurity-tracker.debian.org · CVE-2010-0926
- advisoryRHSA-2012:0313
- advisorysamba.org · symlink_attack.html
- exploitExploitDB-33598
- exploitExploitDB-33599
FAQ
Common Questions.
The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in smbclient to create a symlink containing…
Affected: Samba versions 3.3.0, 3.3.1, 3.3.10, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6; rootio-samba; libsmbclient-devel (oracle), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including ctdb 4.5.0-1.1, ctdb-pcp-pmda 4.5.0-1.1, ctdb-tests 4.5.0-1.1.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2010-0926 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo