CVE-2021-34363: Path Traversal
The thefuck (aka The Fuck) is app that corrects errors in previous console commands. The Fuck python package before 3.31 allows Path Traversal that leads to arbitrary file deletion via the undo archive operation feature.
Other sources
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which installations are affected?
The vulnerability affects versions of the The Fuck Python package before 3.31. Version 3.31 is identified as the release containing the fix.
What does an attacker need to exploit this issue?
The issue is reachable through the package's "undo archive operation" feature. The provided data does not specify any authentication, privilege, or user-interaction prerequisites beyond use of that feature.
What is the impact of successful exploitation?
Path traversal through the undo archive operation can lead to arbitrary file deletion. The supplied severity vector indicates integrity and availability impacts, with no confidentiality impact listed.
What should be done to remediate the issue?
Apply the available patch by upgrading The Fuck Python package to version 3.31 or later.