TI-2020-01831 Aliases CVE-2020-1904 GHSA-v6f2-92p8-cg2q

Path traversal in Meta WhatsApp for iOS

LOW 27CWE-23Published 2020-10-06 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when sending specially crafted docx, xlsx, and pptx files as attachments to messages.

Why it matters now

EPSS 0.01114 66th percentileScored 2026-11-07

Fix Fixed WhatsApp for iOS (Facebook): 2.20.61WhatsApp Business for iOS (Facebook): 2.20.61

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	WhatsApp for iOS	2.20.61; before 2.20.61	2.20.61	Patch available	CNA
Meta	WhatsApp Business for iOS	2.20.61; before 2.20.61	2.20.61	Patch available	CNA

WhatsApp for iOS VendorMeta Affected 2.20.61; before 2.20.61 Fixed in 2.20.61 Patch available CNA
WhatsApp Business for iOS VendorMeta Affected 2.20.61; before 2.20.61 Fixed in 2.20.61 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:whatsapp:whatsapp::::::iphone_os::*	before 2.20.61	Vulnerable	WhatsApp
cpe:2.3:a:whatsapp:whatsapp_business::::::iphone_os::*	before 2.20.61	Vulnerable	WhatsApp

cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:* Versions before 2.20.61 Vulnerable ·WhatsApp
cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:* Versions before 2.20.61 Vulnerable ·WhatsApp

Remediation

Fix · CNA WhatsApp for iOS (Facebook) Fixed in 2.20.61
Fix · CNA WhatsApp Business for iOS (Facebook) Fixed in 2.20.61

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2020-10-06
Facebook WhatsApp Business for iOS, WhatsApp for iOS 2.20.61
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2020-01830 Uncontrolled resource consumption in Meta WhatsApp for iOSPriority LOW 26
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2020-1904
2026-10-03 Alias added: GHSA-v6f2-92p8-cg2q

References

Advisory 1

https://www.whatsapp.com/security/advisories/2020/

TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5

See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences