---
id: CVE-2025-6297
title: >-
  It was discovered that dpkg-deb does not properly sanitize directory
  permissions when extracting a control member into a temporary directory, which
  is

  documented as being a safe operation even on untrusted data
summary: >-
  It was discovered that dpkg-deb does not properly sanitize directory
  permissions when extracting a control member into a temporary directory, which
  is

  documented as being a safe operation even on untrusted data. This may result
  in leavin…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-400
  - CWE-732
vendor: debian
product: dpkg
affected:
  - dpkg < 1.22.21
patched:
  - dpkg 1.22.21
published: '2025-07-01'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-6297'
references:
  - url: >-
      https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=ed6bbd445dd8800308c67236ba35d08004c98e82
    label: security@debian.org
  - url: 'https://lists.debian.org/debian-lts-announce/2026/07/msg00015.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00381
epssPercentile: 0.29403
ingestedAt: '2026-07-08T09:50:34.112Z'
---

## Overview

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is
documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on
adversarial .deb packages or with well compressible files, placed
inside a directory with permissions not allowing removal by a non-root
user, this can end up in a DoS scenario due to causing disk quota
exhaustion or disk full conditions.

## Affected

- `dpkg < 1.22.21`

## Remediation

Upgrade past the affected range:

- `dpkg 1.22.21`