Read the docs
TI-2021-12490 Aliases CVE-2021-32825GHSA-63p8-63ff-xr65

ZipSlip vulnerability in bblfshd

Priority MEDIUM 41CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

bblfshd is an open source self-hosted server for source code parsing. In bblfshd before commit 4265465b9b6fb5663c30ee43806126012066aad4 there is a "zipslip" vulnerability. The unsafe handling of symbolic links in an unpacking routine may enable attackers to read and/or write to arbitrary locations outside the designated target folder. This issue may lead to arbitrary file write (with same permissions as the program running the unpack operation) if the attacker can control the archive file. Additionally, if the attacker has read access to the unpacked files, he may be able to read arbitrary system files the parent process has permissions to read. For more details including a PoC see the referenced GHSL-2020-258.

Why it matters now

EPSS 0.00918 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed bblfshd (bblfsh): 4265465b9b6fb5663c30ee43806126012066aad4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
bblfshbblfshdbefore 4265465b9b6fb5663c30ee43806126012066aad44265465b9b6fb5663c30ee43806126012066aad4Patch availableCNA
  • bblfshd Vendorbblfsh Affected before 4265465b9b6fb5663c30ee43806126012066aad4 Fixed in 4265465b9b6fb5663c30ee43806126012066aad4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:bblfshd_project:bblfshd:*:*:*:*:*:*:*:*before 2021-08-11VulnerableBblfshd Project
  • cpe:2.3:a:bblfshd_project:bblfshd:*:*:*:*:*:*:*:* Versions before 2021-08-11 Vulnerable ·Bblfshd Project

Remediation

  • Fix · CNA bblfshd (bblfsh) Fixed in 4265465b9b6fb5663c30ee43806126012066aad4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32825
  2. 2026-10-03 Alias added: GHSA-63p8-63ff-xr65

References

Exploit 1

Patch 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences