How severe is CVE-2022-1664?

CVE-2022-1664 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2022-1664 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-1664?

CVE-2022-1664 primarily affects Debian Dpkg. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2022-1664?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2022-1664 published?

CVE-2022-1664 was published on 2022-05-26 and last updated on 2026-06-17.

CVE-2022-1664

CVE-2022-1664 is a critical-severity vulnerability in Debian Dpkg with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-22.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 7.5
EPSS exploit prediction: 3% (87th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-22
Affected product: Debian Dpkg
Published: 2022-05-26
Last modified: 2026-06-17

Description

Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.

Frequently asked questions

What is CVE-2022-1664?: Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs.
How severe is CVE-2022-1664?: CVE-2022-1664 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-1664 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-1664?: CVE-2022-1664 primarily affects Debian Dpkg. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2022-1664?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2022-1664 published?: CVE-2022-1664 was published on 2022-05-26 and last updated on 2026-06-17.

References

Affected products (5)

cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

More vulnerabilities in Debian Dpkg

CVE-2017-8283 — Critical (CVSS 9.8): dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection…
CVE-2025-6297 — High (CVSS 8.2): It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into…
CVE-2026-2219 — High (CVSS 7.5): It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate…
CVE-2015-0860 — High (CVSS 7.5): Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb component in Debian dpkg 1.16.x…
CVE-2004-2768 — High (CVSS 7.2): dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which…
CVE-2014-3127 — High (CVSS 7.1): dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that…

All CVEs affecting Debian Dpkg →

Other CWE-22 (Path Traversal) vulnerabilities

CVE-2026-76606 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.3 - ???.
CVE-2026-18051 — Critical (CVSS 10.0): The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache…
CVE-2026-74764 — Critical (CVSS 10.0): Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a…
CVE-2026-16940 — Critical (CVSS 10.0): The Custom Fields WordPress plugin before 1.5.1 does not validate a user-supplied file path before deletion, allowing…
CVE-2026-67429 — Critical (CVSS 10.0): Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related…
CVE-2026-59555 — Critical (CVSS 10.0): Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions.

Browse all CWE-22 (Path Traversal) vulnerabilities →