Path traversal in Wireshark - CVE-2026-5656

Vulnerability identifier: #VU128549

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-5656

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the Configuration Profile import feature. A remote attacker can trick a victim to import a malformed configuration profile and write arbitrary files on the system, leading to arbitrary code execution.

Wireshark
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
openSUSE Leap
wireshark-ui-qt
libwsutil15-debuginfo
libwiretap14
wireshark-ui-qt-debuginfo
libwireshark17
libwiretap14-debuginfo
libwireshark17-debuginfo
wireshark-debugsource
wireshark-devel
wireshark-debuginfo
wireshark
libwsutil15
wireshark (Red Hat package)

Install updates from vendor's website.

Wireshark - addressed in versions 4.4.15, 4.6.5
wireshark-ui-qt - update to 4.2.14-150600.18.41.1
libwsutil15-debuginfo - update to 4.2.14-150600.18.41.1
libwiretap14 - update to 4.2.14-150600.18.41.1
wireshark-ui-qt-debuginfo - update to 4.2.14-150600.18.41.1
libwireshark17 - update to 4.2.14-150600.18.41.1
libwiretap14-debuginfo - update to 4.2.14-150600.18.41.1
libwireshark17-debuginfo - update to 4.2.14-150600.18.41.1
wireshark-debugsource - update to 4.2.14-150600.18.41.1
wireshark-devel - update to 4.2.14-150600.18.41.1
wireshark-debuginfo - update to 4.2.14-150600.18.41.1
wireshark - update to 4.2.14-150600.18.41.1
libwsutil15 - update to 4.2.14-150600.18.41.1
wireshark (Red Hat package) - update to 4.4.2-3.el10_0.4

• https://www.wireshark.org/security/wnpa-sec-2026-21.html

• Multiple vulnerabilities in Wireshark
• Red Hat Enterprise Linux 10 update for wireshark
• SUSE update for wireshark