The host is installed with Pidgin before 2.10.10 and is prone to an absolute path traversal vulnerability. A flaw is present in the application, which fails to properly handle a drive name in a tar archive of a smiley theme. Successful exploitation allows attackers to write to arbitrary files.