CVE-2026-5656
Profile Import Path Traversal in Wireshark
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wireshark | wireshark | From 4.4.0 (inc) to 4.4.15 (exc) |
| wireshark | wireshark | From 4.6.0 (inc) to 4.6.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5656 is a path traversal vulnerability in Wireshark's Configuration Profile import feature. It occurs because the function responsible for unzipping configuration profiles does not properly validate file paths, allowing files to be extracted outside the intended directory.
An attacker can craft a malicious ZIP file containing a Lua script with a path traversal sequence that causes the file to be placed in Wireshark's plugin directory. When Wireshark restarts, it automatically loads this malicious Lua plugin, leading to possible arbitrary code execution or denial of service.
This vulnerability affects Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14. Users are advised to upgrade to versions 4.6.5 or 4.4.15 to mitigate the risk.
How can this vulnerability impact me? :
This vulnerability can lead to denial of service by crashing Wireshark or, more seriously, allow an attacker to execute arbitrary code on your system.
An attacker can exploit this by tricking a user into importing a specially crafted configuration profile ZIP file. The malicious Lua script embedded in the ZIP file can be placed in Wireshark's plugin directory and executed when Wireshark restarts, potentially compromising the user's system.
The attack does not require elevated privileges but does require user interaction to open the malicious file.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves importing a specially crafted configuration profile ZIP file into Wireshark that exploits a path traversal flaw to write files outside the intended directory.
Detection on your system can focus on monitoring for suspicious ZIP files being imported into Wireshark, especially those containing Lua scripts with path traversal sequences such as "../../" in their file paths.
On POSIX systems, you can check the Wireshark plugins directory (~/.local/lib/wireshark/plugins/) for unexpected or recently modified Lua files that could indicate exploitation.
- Use commands like `find ~/.local/lib/wireshark/plugins/ -name '*.lua' -mtime -7` to find Lua scripts added or modified in the last 7 days.
- Inspect imported configuration profile ZIP files before importing by listing their contents with `unzip -l suspicious_profile.zip` and look for file paths containing path traversal patterns (e.g., "../../").
- Monitor Wireshark usage logs or user activity for unexpected profile imports or crashes that could indicate exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Wireshark to a fixed version that addresses this vulnerability.
- Upgrade Wireshark to version 4.6.5 or later, or 4.4.15 or later, as these versions contain the fix for the path traversal issue.
- Avoid importing configuration profiles from untrusted or unknown sources to prevent triggering the vulnerability.
- Regularly audit the Wireshark plugins directory (~/.local/lib/wireshark/plugins/) for unexpected Lua scripts and remove any suspicious files.
- Educate users to be cautious about opening or importing ZIP files or profiles that could contain malicious payloads.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Wireshark allows for possible arbitrary code execution through a path traversal attack when importing malicious configuration profiles. This could lead to unauthorized code running on a user's system.
Such unauthorized code execution and potential system compromise could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system operations.
However, the provided information does not explicitly discuss the direct impact of this vulnerability on compliance with these or other common standards and regulations.