CVE-2020-26279

Path traversal

CVSS 7.7 HIGHEPSS 1.7%CWE-22

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.7EPSS 1.7%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

24 Mar 2021Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Affected products

ipfs · go-ipfs

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2 https://github.com/ipfs/go-ipfs/security/advisories/GHSA-27pv-q55r-222g https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227