{"id":"CVE-2017-1000203","details":"ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution","modified":"2026-07-08T12:05:35.283026Z","published":"2017-11-17T15:29:00.233Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:cern:root:*:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"6.9.03"}],"source":"CPE_RANGE","vendor_product":"cern:root"}]},"references":[{"type":"FIX","url":"https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145#diff-6cd6f6c31bac70116b7ca7abdc8e517e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/root-project/root","events":[{"introduced":"0"},{"fixed":"88ccff152604e0f1012653a596d802ff7ede3145"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v6-09-02","v6-09-01","v6-07-07-aliceml","v6-07-06","v6-07-04","v6-07-02","v6-07-01-ROOTaaS-1","v6-07-01-SMC","v6-06-00-rc1","v6-05-02","v6-05-01","v6-03-04","v6-03-02","v6-03-01-GEANT","v6-01-03-CMS","v6-00-01","v6-00-00","v5-99-06","v5-99-05-lhcb","v5-99-05","v5-99-04","v5-99-03-02","v5-99-03"],"database_specific":{"vanir_signatures_modified":"2026-07-08T12:05:35Z","vanir_signatures":[{"id":"CVE-2017-1000203-2736e482","signature_type":"Line","signature_version":"v1","source":"https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145","target":{"file":"net/rootd/src/rootd.cxx"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["112753023390437046066680255894344038196","123517156889010714442384431770975206213","316444519080085037349782694753551987357","99093815412990079240702988467731680345","202818685289113151301455601335222845516","45564071615389063306530758253293505781","106043677250349546284345886655789412387","216580443221234638991361469579667427538","134412089892240625321618619413959954575","281007198327056708694369896553099641329","185962183112875217976978270617551524244","339924836535862577711667645239577510977","110084261224743742200629177155239205299","324009938050523312682388147983875585878","231636937828318955103526499952062922963","33459720310027446885026851630970123173","56683513029537715666673514504629674426","115381627506399952039611653178989822379","86020575512380833068849907091825749364","307648116939469869973742567850133921666","219945959980363813896675708453239637607","303901509278582510284215863623384858555","158047661268940066323867726847513633735","72976143901312775607729514441720552047","70775874039680259571162346915121337197","225584236103231754011084166541253116676","100922061659222136719594649956879290880","288850413661772075685715919060719766367","98169883291735485382111839410171923366","52924782885705114316567733726903285730","55675883973581524339662677944904579521","181563457620331410824485064497192167399","180197842868448626578640926002815727726","2765484493273865015285824152053262473","160610574935288005355579457149305971505","162270327565993380573405142810501620527","70007776433875758597923031275220715646","255618159532986291687774512489754334329","80965336328161819311447904291333075595","41224680307054186787987627257177511419","320121713036123163252532015636439111878","134590569041454291692296671813123903983","107944684708972575727944962796974179088","263942219941744514654057652285357765905","243121496701498707295568671820033839648","116615655696998485008977315936990093323","62639376307337962544579716271568128698","225556828926182832133132209119482477400","165003015741312680310387913810974896290","36066159252398843538500749807430620078","301333998832435912781535119339794965316","28269054716495731367265790651148266773","291673312580007308947693858185591999084","129670893985192603159624452774660968253","151964357557639302019744657912646911590","121757222430576452824634487216314630803","104379560390618016983286509338657484327","247097512253544022077169055387558657970","15714710988157363461761623186516069323","300821520990157970512367894808099727089","70184531578177693922528676928601531211","273454785728586583737859777090487396807","211224932529602829192173956870556600885","310772128750058862171876705087523246627","104154434686378432063864787242503033331","339855587731940272513500773794509192636","113788488836915161422153569599069093918","236008318659829831235326782589757587689","4784015926381732585071848264033975824","12156001560741619506851390858831396070","145593847246462578666687922795146421846","309850584636941694475302670793655137515","107222694161766417860077166476588736073","6926204206266658473475360331285094780","154924526926421383751932498116844474841","285294501526729698953075627659094625375","81198982305453458634991868954012477091","89162472561366542698066725936851827582","153519733002584630652622627453281608824","17775631045531039315537459832739560375","196961466819168363487964231666808190054","291636275074047172633574870226626830703","109776333268042549044925964133746605837","143108012570852904972787608972482361795","34188040184926727952430822167425886659","299611116597531704112681972313799712834","245364550258958990473126234918026981578","211416308056142327703101286156156981410","322040977545311111268855558642934136398","41409893408051260314970180125422032533"]}},{"source":"https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145","target":{"file":"net/rootd/src/rootd.cxx","function":"EscChar"},"deprecated":false,"digest":{"function_hash":"206517645880636505625366685285519061412","length":428},"id":"CVE-2017-1000203-65f5cbf5","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"54949823848819537940751754714504015652","length":1779},"id":"CVE-2017-1000203-b4cfee45","signature_type":"Function","signature_version":"v1","source":"https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145","target":{"file":"net/rootd/src/rootd.cxx","function":"RootdExpandPathName"},"deprecated":false}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000203.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}