CVE-2024-1485CWE-22

Registry-support: decompress can delete files outside scope via relative paths

High · published February 13, 2024

CVSS v3.1
8.0
EPSS
1%
Percentile
60.6
In the wild
Unconfirmed
What it is

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00942 · 60.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-02-13T23:31Z
EPSS history
Timeline
  • 13 FEB 23:31Z
    Registry-support: decompress can delete files outside scope via relative paths
    cvelistv5