CVE-2013-2900: Debian Linux

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.

Affected products

• Debian Debian Linux: version 7.0 only
• Google Chrome: up to and including 29.0.1547.56; version 29.0.1547.0 only; version 29.0.1547.1 only; version 29.0.1547.2 only; version 29.0.1547.3 only; version 29.0.1547.4 only; …

Published 2013-08-21. Last modified 2026-06-16.