** DISPUTED ** chmextract.c in the chmextract sample program as distributed with libmspack before 0.8alpha does not protect against absolute/relative pathnames in CHM files leading to Directory Traversal. NOTE: the vendor disputes that this is a libmspack vulnerability because chmextract.c was only intended as a source-code example not a supported application.