Path traversal in github.com/whyrusleeping/tar-utils
Priority MEDIUM 49CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.
Summary
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01111 66th percentileScored 2026-11-07
Fix Fixed github.com/whyrusleeping/tar-utils (github.com/whyrusleeping/tar-utils): 0.0.0-20201201191210-20a61371de5bgithub.com/whyrusleeping/tar-utils (Go): 0.0.0-20201201191210-20a61371de5b
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| github.com/whyrusleeping/tar-utils | github.com/whyrusleeping/tar-utils | before 0.0.0-20201201191210-20a61371de5b | 0.0.0-20201201191210-20a61371de5b | Patch available | CNA |
| — | github.com/whyrusleeping/tar-utils (Go) | before 0.0.0-20201201191210-20a61371de5b | 0.0.0-20201201191210-20a61371de5b | Patch available | GHSA-jpf8-h7h7-3ppm |
- github.com/whyrusleeping/tar-utils Vendorgithub.com/whyrusleeping/tar-utils Affected before 0.0.0-20201201191210-20a61371de5b Fixed in 0.0.0-20201201191210-20a61371de5b Patch available CNA
- github.com/whyrusleeping/tar-utils (Go) Vendor— Affected before 0.0.0-20201201191210-20a61371de5b Fixed in 0.0.0-20201201191210-20a61371de5b Patch available GHSA-jpf8-h7h7-3ppm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tar-utils_project:tar-utils:*:*:*:*:*:go:*:* | before 0.0.0-20201201191210-20a61371de5b | Vulnerable | Tar-utils Project |
- cpe:2.3:a:tar-utils_project:tar-utils:*:*:*:*:*:go:*:* Versions before 0.0.0-20201201191210-20a61371de5b Vulnerable ·Tar-utils Project
Remediation
- Fix · CNA github.com/whyrusleeping/tar-utils (github.com/whyrusleeping/tar-utils) Fixed in 0.0.0-20201201191210-20a61371de5b
- Fix · GHSA-jpf8-h7h7-3ppm github.com/whyrusleeping/tar-utils (Go) Fixed in 0.0.0-20201201191210-20a61371de5b Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36566
- 2026-10-03 Alias added: GHSA-jpf8-h7h7-3ppm
References
Sources
- CVE-2020-36566 · CVE Program
- CVE-2020-36566 · NVD
- FIRST EPSS
- GHSA-jpf8-h7h7-3ppm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences