CVE-2017-18196: Leptonica

Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Leptonica 1.74.4 constructs unintended pathnames (containing duplicated path components) when operating on files in /tmp subdirectories, which might allow local users to bypass intended file restrictions by leveraging access to a directory located deeper within the /tmp directory tree, as demonstrated by /tmp/ANY/PATH/ANY/PATH/input.tif.

Affected products

• Leptonica Leptonica: version 1.74.4 only

Published 2018-02-23. Last modified 2026-06-17.