https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-14452.htmlhttps://patchthecve.com/cve/CVE-2019-14452.htmlWed, 17 Jun 2026 02:18:27 +0000HIGH 7.5: Sigil before 0.9.16 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.https://patchthecve.com/cve/CVE-2019-13241.htmlhttps://patchthecve.com/cve/CVE-2019-13241.htmlWed, 17 Jun 2026 02:16:21 +0000HIGH 7.8: FlightCrew v0.9.2 and older are vulnerable to a directory traversal, allowing attackers to write arbitrary files via a ../ (dot dot slash) in a ZIP archive entry that is mishandled during extraction.https://patchthecve.com/cve/CVE-2019-13032.htmlhttps://patchthecve.com/cve/CVE-2019-13032.htmlWed, 17 Jun 2026 02:15:57 +0000MEDIUM 5.5: An issue was discovered in FlightCrew v0.9.2 and earlier. A NULL pointer dereference occurs in GetRelativePathToNcx() or GetRelativePathsToXhtmlDocuments() when a NULL pointer is passed to xc::XMLUri::isValidURI(). This affects third-party software (not Sigil) that uses FlightCrew as a library.