https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 19:20:49 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-04607 bdu:2024-04607 https://cve.radiocsirt.org/vuln/bdu:2024-04607 https://cve.radiocsirt.org/vuln/euvd-2026-4621 EUVD-2026-4621 https://cve.radiocsirt.org/vuln/euvd-2026-4621 https://cve.radiocsirt.org/vuln/fkie_cve-2024-29188 <p>WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX&#39;s `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.</p> <p>WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX&#39;s `RemoveFolderEx` functionality could allow a standard user to delete protected directories. `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction. This vulnerability is fixed in 3.14.1 and 4.0.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-29188 https://cve.radiocsirt.org/vuln/ghsa-jx4p-m4wm-vvjg <p><strong>Affected:</strong> NuGet: wix, NuGet: WixToolset.Util.wixext</p> <p>### Summary The custom action behind WiX&#39;s `RemoveFolderEx` functionality could allow a standard user to delete protected directories.</p> <p>### Details `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction.</p> <p><strong>Affected:</strong> NuGet: wix, NuGet: WixToolset.Util.wixext</p> <p>### Summary The custom action behind WiX&#39;s `RemoveFolderEx` functionality could allow a standard user to delete protected directories.</p> <p>### Details `RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction.</p> https://cve.radiocsirt.org/vuln/ghsa-jx4p-m4wm-vvjg https://cve.radiocsirt.org/vuln/gsd-2024-29188 gsd-2024-29188 https://cve.radiocsirt.org/vuln/gsd-2024-29188