CVE-2004-0180: Cvs

Low severity, CVSS 2.6. EPSS: 1.8% chance of exploitation in the next 30 days.

The client for CVS before 1.11 allows a remote malicious CVS server to create arbitrary files using certain RCS diff files that use absolute pathnames during checkouts or updates, a different vulnerability than CVE-2004-0405.

Affected products

• Cvs Cvs: up to and including 1.10

Published 2004-06-01. Last modified 2026-06-16.