CVE-2018-25046 Path traversal in code.cloudfoundry.org/archiver

2022-12-2721:13:15

www.cve.org

cve-2018-25046

path traversal

code.cloudfoundry.org/archiver

improper path sanitization

relative file paths

target directory

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

46.6%

JSON

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

CNA Affected

[
  {
    "vendor": "code.cloudfoundry.org/archiver",
    "product": "code.cloudfoundry.org/archiver/extractor",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "code.cloudfoundry.org/archiver/extractor",
    "versions": [
      {
        "version": "0",
        "lessThan": "0.0.0-20180523222229-09b5706aa936",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "extractTarArchiveFile"
      },
      {
        "name": "extractZipArchiveFile"
      },
      {
        "name": "detectableExtractor.Extract"
      },
      {
        "name": "tarExtractor.Extract"
      },
      {
        "name": "tgzExtractor.Extract"
      },
      {
        "name": "zipExtractor.Extract"
      }
    ],
    "defaultStatus": "unaffected"
  }
]