CVE-2020-36314

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

CVSS v3.1

3.9 LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

CVSS v2.0

2.6 LOWAV:L/AC:H/Au:N/C:N/I:P/A:P

EPSS

0.61% chance of exploitation in the next 30 days, 47th percentile

Published

2021-04-07

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://gitlab.gnome.org/GNOME/file-roller/-/issues/108

References

• CVE Record
• NVD entry

Related

• CVE-2020-36289
• CVE-2020-36315
• CVE-2020-36287
• CVE-2020-36316
• CVE-2020-36241
• CVE-2020-36317