CVE catalog

CVE-2022-48682

fdupes: CVE-2022-48682

[CVE catalog]

Severity
Medium · CVSS 6CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 27, 2026

In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianfdupessid1:2.4.0-1fixed
Debianfdupesforky1:2.4.0-1fixed
Debianfdupestrixie1:2.3.2-1fixed
Debianfdupesbookworm1:2.2.1-1fixed
Ubuntufdupes16.041.51-1vulnerable
Ubuntufdupes18.041:1.6.1-1vulnerable
Ubuntufdupes20.041:1.6.1-2vulnerable
Ubuntufdupes22.041:2.1.2-1build1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianfdupessourcesid1:2.2.1-1not yet assignedNot reportedNot reported
Debianfdupessourceforky1:2.2.1-1not yet assignedNot reportedNot reported
Debianfdupessourcetrixie1:2.2.1-1not yet assignedNot reportedNot reported
Debianfdupessourcebookworm1:2.2.1-1not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [fdupes]Fixed
    Details (2)

    • 1:2.2.1-1 · amd64 · bookworm

      Fixed · Fixed: 1:2.2.1-1

      dsa · fdupes · debian · bookworm

    • 1:2.2.1-1 · arm64 · bookworm

      Fixed · Fixed: 1:2.2.1-1

      dsa · fdupes · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]