GHSA-47WR-426J-FR82 Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer

🗓️ 12 Feb 2022 00:14:07Reported by GoogleType

osv🔗 osv.dev👁 19 Views

Symbolic links in unpacking routine can enable attackers to read/write to arbitrary locations in dbdeployer. Mitigating factors include user privilege and tarball source verification. An attacker may inject a symbolic link to a critical file, resulting in system compromise. Remedies include evaluating link targets, and applying depth comparison to block malicious operations. Version 1.58.2 contains patch

Reporter	Title	Published	Views	Family All 11
circl	CVE-2020-26277	22 Dec 202000:52	–	circl
cnnvd	Datacharmer Dbdeployer Backlink Vulnerability	21 Dec 202000:00	–	cnnvd
cve	CVE-2020-26277	21 Dec 202021:15	–	cve
cvelist	CVE-2020-26277 Arbitrary read/write in DBdeployer	21 Dec 202021:15	–	cvelist
euvd	EUVD-2022-0806	3 Oct 202520:07	–	euvd
github	Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer	12 Feb 202200:14	–	github
nvd	CVE-2020-26277	21 Dec 202022:15	–	nvd
osv	GO-2022-0787 Symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations in dbdeployer in github.com/datacharmer/dbdeployer	21 Aug 202415:28	–	osv
prion	Design/Logic Flaw	21 Dec 202022:15	–	prion
ptsecurity	PT-2020-16399 · Mysql Server · Dbdeployer	21 Dec 202000:00	–	ptsecurity

Source	Link
github	www.github.com/datacharmer/dbdeployer/security/advisories/GHSA-47wr-426j-fr82
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-26277
github	www.github.com/datacharmer/dbdeployer/commit/548e256c1de2f99746e861454e7714ec6bc9bb10

08 Jul 2026 05:59Current

6Medium risk

Vulners AI Score6

CVSS 3.16.1

EPSS0.01186