CVE-2007-6610: Debian Unp

High severity, CVSS 10.0. EPSS: 2.3% chance of exploitation in the next 30 days.

unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product.

Affected products

• Debian Unp: up to and including 1.0.12

Published 2008-01-03. Last modified 2026-06-16.