CVE-2006-0926: Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, a

Routine

LOW 2.6DOWNGRADEDOWNGRADEDOWNGRADE

CVE-2006-0926 is a low-severity flaw (CVSS 2.6) affecting stuffit deluxe, stuffit expander, stuffit standard. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a (1) zip or (2) tar archive.

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	2.6 (Low)
EPSS exploit chance	1.6% (top 24%)
CISA exploited list	No
Published	2006-02-28
Last modified	2026-06-16

Publisher (CNA): MITRE · Vendor: smithmicro

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2006-02-28 11:02 UTCPublished CVE record published
2026-06-16 22:21 UTCUpdated Record last modified

smithmicro stuffit deluxe DOWNGRADE

Affected: 9.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0

1. Check installed version

apt-cache policy stuffit-deluxe || rpm -q stuffit-deluxe || stuffit-deluxe --version

2. No fixed release: DOWNGRADE to a release before 9.0 (Debian / Ubuntu)

apt-cache madison stuffit-deluxe sudo apt install stuffit-deluxe=<VERSION_BEFORE_9.0> sudo apt-mark hold stuffit-deluxe

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list stuffit-deluxe sudo dnf downgrade stuffit-deluxe-<VERSION_BEFORE_9.0> sudo dnf versionlock add stuffit-deluxe

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

smithmicro stuffit expander DOWNGRADE

Affected: 9.0.0.21_engine_9.0.0.21

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0.0.21_engine_9.0.0.21

1. Check installed version

apt-cache policy stuffit-expander || rpm -q stuffit-expander || stuffit-expander --version

2. No fixed release: DOWNGRADE to a release before 9.0.0.21_engine_9.0.0.21 (Debian / Ubuntu)

apt-cache madison stuffit-expander sudo apt install stuffit-expander=<VERSION_BEFORE_9.0.0.21_engine_9.0.0.21> sudo apt-mark hold stuffit-expander

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list stuffit-expander sudo dnf downgrade stuffit-expander-<VERSION_BEFORE_9.0.0.21_engine_9.0.0.21> sudo dnf versionlock add stuffit-expander

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

smithmicro stuffit standard DOWNGRADE

Affected: 9.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0

1. Check installed version

apt-cache policy stuffit-standard || rpm -q stuffit-standard || stuffit-standard --version

2. No fixed release: DOWNGRADE to a release before 9.0 (Debian / Ubuntu)

apt-cache madison stuffit-standard sudo apt install stuffit-standard=<VERSION_BEFORE_9.0> sudo apt-mark hold stuffit-standard

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list stuffit-standard sudo dnf downgrade stuffit-standard-<VERSION_BEFORE_9.0> sudo dnf versionlock add stuffit-standard

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

smithmicro zipmagic deluxe DOWNGRADE

Affected: 9.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0

1. Check installed version

apt-cache policy zipmagic-deluxe || rpm -q zipmagic-deluxe || zipmagic-deluxe --version

2. No fixed release: DOWNGRADE to a release before 9.0 (Debian / Ubuntu)

apt-cache madison zipmagic-deluxe sudo apt install zipmagic-deluxe=<VERSION_BEFORE_9.0> sudo apt-mark hold zipmagic-deluxe

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list zipmagic-deluxe sudo dnf downgrade zipmagic-deluxe-<VERSION_BEFORE_9.0> sudo dnf versionlock add zipmagic-deluxe

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2006-0926?

stuffit deluxe: downgrade or apply the listed mitigation; stuffit expander: downgrade or apply the listed mitigation; stuffit standard: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2006-0926 being exploited?

CVE-2006-0926 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2006-0926 affect?

CVE-2006-0926 affects stuffit deluxe, stuffit expander, stuffit standard. Severity is low (CVSS 2.6). Multiple directory traversal vulnerabilities in Allume StuffIt Standard and Deluxe 9.0, ZipMagic Deluxe 9.0, and StuffIt Expander 9.0.0.21 Engine 9.0.0.21 allow remote attackers to create and overwrite arbitrary files via certain crafted pa

How urgent is CVE-2006-0926?

Priority 28/100. No elevated risk signals yet.

References

← Back to latest CVEs