Read the docs
TI-2020-16100 Aliases CVE-2020-26279GHSA-27pv-q55r-222g

Path traversal in ipfs go-ipfs

Priority LOW 39CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Why it matters now

EPSS 0.01699 77th percentileScored 2026-11-07
Fix Fixed go-ipfs (ipfs): 0.8.0-rc1github.com/ipfs/go-ipfs (Go): 0.8.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ipfsgo-ipfsbefore 0.8.0-rc10.8.0-rc1Patch availableCNA
—github.com/ipfs/go-ipfs (Go)before 0.8.00.8.0Patch availableGHSA-27pv-q55r-222g
  • go-ipfs Vendoripfs Affected before 0.8.0-rc1 Fixed in 0.8.0-rc1 Patch available CNA
  • github.com/ipfs/go-ipfs (Go) Vendor— Affected before 0.8.0 Fixed in 0.8.0 Patch available GHSA-27pv-q55r-222g

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:protocol:go-ipfs:*:*:*:*:*:*:*:*up to 0.7.0VulnerableProtocol
  • cpe:2.3:a:protocol:go-ipfs:*:*:*:*:*:*:*:* Versions up to 0.7.0 Vulnerable ·Protocol

Remediation

  • Fix · CNA go-ipfs (ipfs) Fixed in 0.8.0-rc1
  • Fix · GHSA-27pv-q55r-222g github.com/ipfs/go-ipfs (Go) Fixed in 0.8.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26279
  2. 2026-10-03 Alias added: GHSA-27pv-q55r-222g

References

Patch 2

Advisory 2

  • TI-2023-09455 Denial of service when feeding malformed size arguments in go-bitfield CVSS 3.1HIGH 7.5
  • TI-2023-10871 Boxo bitswap/server: DOS unbounded persistent memory leak CVSS 3.1HIGH 8.2
  • TI-2020-08933 Exposure of Sensitive Information to an Unauthorized Actor in AEgir CVSS 3.1CRITICAL 9.6
  • TI-2022-07554 ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag CVSS 3.1HIGH 7.5
  • TI-2020-16104 Control character injection in console output CVSS 3.1HIGH 8.8
  • TI-2016-08604 Cryptographic flaw in HackerOne go-ipfs-dep node module CVSS 3.0HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences