CVE-2020-36560

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Dec 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-365619.1Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the tar CVE-2020-365627.5Due to unchecked type assertions, maliciously crafted messages can cause panics, which may be used as a denial of service vector.CVE-2020-365635.3XML Digital Signatures generated and validated using this package use SHA-1, which may allow an attacker to craft inputs which cause hash co CVE-2020-365647.5Due to improper validation of caller input, validation is silently disabled if the provided expected token is malformed, causing any user su CVE-2020-365655.3Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read CVE-2020-365669.1Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the tar CVE-2020-365677.5Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.CVE-2020-365687.5Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memor CVE-2020-365699.1Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-202001311 CVE-2020-36579.8u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client th CVE-2020-36589.1Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute,CVE-2020-365999.8lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.