PT-2021-5613 · Gnome+8 · File Roller+8

Published 2021-01-07 · Updated 2025-01-07 · CVE-2020-36314

Positive Technologies (AI Summary)

CVSS v3.1

3.9

Low

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions File Roller versions through 3.38.0

Description The issue is related to a directory traversal vulnerability during extraction, caused by the lack of a check for whether a file's parent is a symlink in certain complex situations. This vulnerability may allow an attacker to impact the integrity and availability of protected information.

Recommendations For versions through 3.38.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Link Following

Weakness Enumeration

CWE-22

CWE-59

Related Identifiers

ALSA-2021:4179

ALT-PU-2021-1631

BDU:2022-00048

CESA-2021_4179

CVE-2020-36314

MGASA-2021-0311

OPENSUSE-SU-2024:10756-1

RHSA-2021:4179

RHSA-2021_4179

RLSA-2021:4179

SUSE-SU-2025:0032-1

SUSE-SU-2025_0032-1

USN-4927-1

Affected Products

Alt Linux

Almalinux

Centos

File Roller

Linuxmint

Red Hat

Rocky Linux

Suse

Ubuntu

References · 34

• 🔥 https://gitlab.gnome.org/GNOME/file-roller/-/issues/108 · Exploit
• https://ubuntu.com/security/CVE-2020-36314 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2021:4179 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10756-1 · Vendor Advisory
• https://gitlab.gnome.org/GNOME/file-roller/-/commit/e970f4966bf388f6e7c277357c8b186c645683ae · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0032-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36314 · Security Note
• https://advisories.mageia.org/MGASA-2020-0218.html · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0311 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KJBZVCHQ4SSX2JAJZVJ5J4P3GEMXJ75 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36314 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00048 · Security Note
• https://osv.dev/vulnerability/USN-4927-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6KJBZVCHQ4SSX2JAJZVJ5J4P3GEMXJ75 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4927-1 · Vendor Advisory