CVE-2020-36241: Path Traversal
autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-36241?
CVE-2020-36241 is a vulnerability in GNOME gnome-autoar through version 0.2.4 that allows Directory Traversal during extraction.
Which software is affected by CVE-2020-36241?
GNOME Shell, Nautilus, and other software that use gnome-autoar version 0.2.4 are affected by CVE-2020-36241.
How severe is CVE-2020-36241?
CVE-2020-36241 has a severity level of medium with a CVSS score of 5.5.
How can CVE-2020-36241 be exploited?
CVE-2020-36241 can be exploited through Directory Traversal by extracting files without checking if the parent directory is a symlink.
Is there a fix for CVE-2020-36241?
Yes, a fix for CVE-2020-36241 is available in the updated version of gnome-autoar.