CVE-2020-26279

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
ipfs	go-ipfs	< 0.8.0-rc1

References

https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2Patch, Third Party Advisory
https://github.com/ipfs/go-ipfs/security/advisories/GHSA-27pv-q55r-222gThird Party Advisory
https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227Patch, Third Party Advisory
https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2Patch, Third Party Advisory
https://github.com/ipfs/go-ipfs/security/advisories/GHSA-27pv-q55r-222gThird Party Advisory
https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227Patch, Third Party Advisory

Timeline

Published: Mar 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-26286.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). Supported versions CVE-2020-262808.9OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. O CVE-2020-262817.5async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.CVE-2020-2628210.0BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. Brows CVE-2020-262838.8go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8 CVE-2020-262848.5Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pa CVE-2020-262857.2OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which ena CVE-2020-262867.5HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can uplo CVE-2020-262878.7HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `sc CVE-2020-262886.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. It is an npm package "parse-server".CVE-2020-262897.5date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved CVE-2020-26296.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported v