CVE-2020-7669

Arbitrary File Write via Archive Extraction (Zip Slip)

High · published September 1, 2020

CVSS v3.0
7.5
EPSS
2%
Percentile
78.7
In the wild
Unconfirmed
What it is

This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01830 · 78.7th percentile
Published
2020-09-01T13:55Z
EPSS history
Timeline
  • 01 SEP 13:55Z
    Arbitrary File Write via Archive Extraction (Zip Slip)
    cvelistv5