Path Traversal in decompress

GHSA-qgfr-5hqp-vrw9 · CVE-2020-12265

Published Sep 3, 2020 · Modified Nov 8, 2023

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

Versions of decompress prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing../.

Recommendation

Upgrade to version 4.2.1 or later.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-12265
WEB https://github.com/kevva/decompress/issues/71
WEB https://github.com/kevva/decompress/pull/73
WEB https://github.com/kevva/decompress/commit/967146e70f48be32ed1a69daa3941d681944d513
PACKAGE https://github.com/kevva/decompress

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes