Do_directory in cramfsck.c of npitre cramfs-tools allows a local attacker to construct file names that escape the intended directory boundaries, resulting in a path traversal vulnerability (CWE-22). This flaw permits reading or creating arbitrary files relative to the working directory, potentially exposing sensitive data or permitting the attacker to write malicious files, respectively. The vulnerability was discovered in versions up to 2.1 and has been publicly disclosed through a patch identified by commit 2fc492747115b24d8a07eddd27a2d45229cb273c.

Versions of npitre cramfs-tools up to 2.1 are affected. Upgrading to the released 2.2 version fully resolves the issue. Prior to the update, any non-privileged local user with access to cramfsck could navigate outside the expected directory structure.

The CVSS score of 4.8 indicates a moderate risk, and no EPSS score is published, so the likelihood of exploitation remains uncertain but possible in environments where local access to cramfs-tools is available. It is not included in the CISA KEV catalog, which suggests no widespread known exploitation. Nevertheless, because the flaw is local, administrators who provide shell or command‑line access to users that can invoke cramfsck should evaluate their trust boundaries or mitigate with the available patch.