CVE-2013-2900 — Path Traversal in Google Chrome

CWE-22 — Path Traversal6 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 49.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google ChromeDebian Linux
Timeline
PublishedAug 21
Latest updateSep 11

Description

The FilePath::ReferencesParent function in files/file_path.cc in Google Chrome before 29.0.1547.57 on Windows does not properly handle pathname components composed entirely of . (dot) and whitespace characters, which allows remote attackers to conduct directory traversal attacks via a crafted directory name.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDgoogle/chrome29.0.1547.56+50

Also affects: Debian Linux 7.0

🔴Vulnerability Details

1
GHSA
GHSA-6j6r-x8xq-r7gq: The FilePath::ReferencesParent function in files/file_path↗2022-05-17
▶

🕵️Threat Intelligence

4
Qualys
Patch Tuesday Risk Elimination with Agent Sara↗2025-09-11
▶
Qualys
Qualys Agent Sara for Risk Elimination: Agentic AI Patching Guide | Qualys↗2025-09-11
▶
Qualys
Mitigate High-Risk Vulnerabilities Using TruRisk | Qualys↗2024-12-04
▶
Qualys
Proactively Managing High-Risk Vulnerabilities with TruRisk Mitigate™↗2024-12-04
▶
CVE-2013-2900 — Path Traversal in Google Chrome | cvebase