GHSA-84xv-jfrm-h4gmMediumCVSS 8.0

registry-support: decompress can delete files outside scope via relative paths

Published
February 14, 2024
Last Modified
February 27, 2026

🔗 CVE IDs covered (1)

📋 Description

A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.

🎯 Affected products1

  • go/github.com/devfile/registry-support/registry-library:< 0.0.0-20240206

🔗 References (6)