Input validation

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2020-36566 Path traversal in github.com/whyrusleeping/tar-utils

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2020-36566

CVE-2020-36566 : A path traversal in the Go tar-utils library (github.com/whyrusleeping/tar-utils) allows archives with relative paths to write or overwrite files outside the target directory due to improper path sanitization. The vulnerability impacts tar-utils used in the go-ipfs codebase, with...

CVE-2020-36561

CVE-2020-36561 is a path-traversal vulnerability in the unzip library used by github.com/yi-ge/unzip (go-unzip). The root cause is improper path sanitization that allows archives containing relative file paths to write or overwrite files outside the target directory. Documents indicate the issue ...

CVE-2020-36560 Path traversal in github.com/artdarek/go-unzip

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2020-36560

CVE-2020-36560 corresponds to a path traversal vulnerability in the Go library go-unzip (github.com/artdarek/go-unzip). The root cause is improper path handling during archive extraction, enabling archives containing relative file paths to write or overwrite files outside the intended target dire...

CVE-2020-36560 Path traversal in github.com/artdarek/go-unzip

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2019-25073

The CVE-2019-25073 entry affects github.com/goadesign/goa: versions prior to v3.0.9, v2.0.10, and v1.4.3 are vulnerable due to improper path sanitization, allowing remote attackers to read files outside the intended directory. This path traversal could expose sensitive files in affected deploymen...

CVE-2018-25046 Path traversal in code.cloudfoundry.org/archiver

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2018-25046

CVE-2018-25046 is a path traversal flaw in the cloudfoundry/archiver package. The published descriptions across multiple sources (including Red Hat security, OSV, and CVE records) confirm that archives containing relative file paths can cause files to be written or overwritten outside the intende...

CVE-2019-25073: Improper Limitation of a Pathname to a Restricted Directory

Improper path sanitization in github.com/goadesign/goa before v3.0.9, v2.0.10, or v1.4.3 allow remote attackers to read files outside of the intended directory...

CVE-2018-25046: Improper Limitation of a Pathname to a Restricted Directory

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2020-36566: Improper Limitation of a Pathname to a Restricted Directory

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2020-36560: Improper Limitation of a Pathname to a Restricted Directory

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

CVE-2020-36561: Improper Limitation of a Pathname to a Restricted Directory

Due to improper path sanitization, archives containing relative file paths can cause files to be written or overwritten outside of the target directory...

Directory Traversal

Overview @nubosoftware/node-static is a simple, compliant file streaming module for node Affected versions of this package are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith method in the servePath function. PoC js curl --path-as-is...

Directory Traversal

Overview node-static is a rfc 2616 compliant HTTP static-file server module, with built-in caching. Affected versions of this package are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith method in the servePath function. PoC js curl --path-as-is...

KubeVirt vulnerable to arbitrary file read on host

As part of a Kubevirt audit performed by NCC group, a finding dealing with systemic lack of path sanitization which leads to a path traversal was identified. Google tested the exploitability of the paths in the audit report and identified that when combined with another vulnerability one of the...

Duplicate Advisory: KubeVirt arbitrary host file read from the VM

Duplicate Advisory This advisory is a duplicate of GHSA-qv98-3369-g364. This link is maintained to preserve external references. Original Description Summary As part of a Kubevirt audit performed by NCC group, a finding dealing with systemic lack of path sanitization which leads to a path travers...

GHSA-CVX8-PPMC-78HM Duplicate Advisory: KubeVirt arbitrary host file read from the VM

Duplicate Advisory This advisory is a duplicate of GHSA-qv98-3369-g364. This link is maintained to preserve external references. Original Description Summary As part of a Kubevirt audit performed by NCC group, a finding dealing with systemic lack of path sanitization which leads to a path travers...