PT-2020-13083 · Unknown · Decompress

Stdunlap607 · Published 2020-04-26 · Updated 2026-06-05 · CVE-2020-12265

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions decompress versions prior to 4.2.1

Description The issue allows for Arbitrary File Write via ../ in an archive member when a symlink is used, due to Directory Traversal. This occurs because the package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing ../.

Recommendations Upgrade to version 4.2.1 or later. As a temporary workaround, consider restricting the use of the decompress package until the issue is resolved. Avoid using the decompress package to extract archives that may contain symlinks or relative paths.

Exploit

Fix

Link Following

Path traversal

Weakness Enumeration

CWE-59

CWE-22

Related Identifiers

CVE-2020-12265

GHSA-QGFR-5HQP-VRW9

Affected Products

Decompress

References · 10

• 🔥 https://github.com/kevva/decompress/issues/71 · Exploit
• https://github.com/kevva/decompress/pull/73 · Patch
• https://osv.dev/vulnerability/CVE-2020-12265 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12265 · Security Note
• https://osv.dev/vulnerability/GHSA-qgfr-5hqp-vrw9 · Vendor Advisory
• https://github.com/kevva/decompress · Note
• https://github.com/kevva/decompress/commit/967146e70f48be32ed1a69daa3941d681944d513 · Note
• https://t.me/CVEtracker/55925 · Telegram Post
• https://t.me/cvenotify/3219 · Telegram Post
• https://npmjs.com/advisories/1217 · Note