CVE-2015-5070: Fedoraproject Fedora

Low severity, CVSS 3.1. EPSS: 1.4% chance of exploitation in the next 30 days.

The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.

Affected products

• Fedoraproject Fedora: version 21 only; version 22 only
• Wesnoth Battle For Wesnoth: up to and including 1.12.2; version 1.13.0 only

Published 2017-09-26. Last modified 2026-06-17.