CVE-2018-7442: Leptonica

Critical severity, CVSS 9.1. EPSS: 2% chance of exploitation in the next 30 days.

An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function does not block '/' characters in the gplot rootname argument, potentially leading to path traversal and arbitrary file overwrite.

Affected products

• Leptonica Leptonica: up to and including 1.75.3

Published 2018-02-23. Last modified 2026-06-17.