CVE-2020-36566

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
github.com/whyrusleeping/tar-utils	github.com/whyrusleeping/tar-utils	< 0.0.0-20201201191210-20a61371de5b

References

https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227Patch, Third Party Advisory
https://pkg.go.dev/vuln/GO-2021-0106Third Party Advisory
https://snyk.io/research/zip-slip-vulnerabilityTechnical Description, Third Party Advisory
https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227Patch, Third Party Advisory
https://pkg.go.dev/vuln/GO-2021-0106Third Party Advisory
https://snyk.io/research/zip-slip-vulnerabilityTechnical Description, Third Party Advisory

Timeline

Published: Dec 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-365677.5Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.CVE-2020-365687.5Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memor CVE-2020-365699.1Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-202001311 CVE-2020-36579.8u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client th CVE-2020-36589.1Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute,CVE-2020-365999.8lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.CVE-2020-36609.8Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute,CVE-2020-366007.5Out-of-bounds write vulnerability in the power consumption module. Successful exploitation of this vulnerability may cause the system to res CVE-2020-366017.5Out-of-bounds write vulnerability in the kernel modules. Successful exploitation of this vulnerability may cause a panic reboot.CVE-2020-366026.1There is an out-of-bounds read and write vulnerability in some headset products. An unauthenticated attacker gets the device physically and CVE-2020-366036.5The HoYoVerse (formerly miHoYo) Genshin Impact mhyprot2.sys 1.0.0.0 anti-cheat driver does not adequately restrict unprivileged function cal CVE-2020-366048.1hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.