CVE-2020-26279CWE-22

Path traversal

High · published March 24, 2021

CVSS v3.1
7.7
EPSS
2%
Percentile
77.0
In the wild
Unconfirmed
What it is

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01699 · 77.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2021-03-24T20:20Z
EPSS history
Timeline
  • 24 MAR 20:20Z
    Path traversal
    cvelistv5