Path Traversal in Ipfs Go-Ipfs
CVE-2020-26279
go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.017 (74.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Ipfs Go-ipfs — versions < 0.8.0-rc1
- Protocol Go-ipfs
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-26279?
- CVE-2020-26279 is a high-severity vulnerability in Ipfs Go-Ipfs, classified under Path Traversal. CVSS score: 7.7/10. Published 2021-03-24.
- How severe is CVE-2020-26279?
- High severity. CVSS v3 base score is 7.7 out of 10.
- Is CVE-2020-26279 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.