CVE-2020-26279 - CVE House
Back to Database
Status published High CVE-2020-26279

Path traversal

Vulnerability Description

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26279

Credits & Attribution

No credits recorded in the NVD database.

References

More from ipfs

View All →
CVE-2023-25568
Boxo bitswap/server: DOS unbounded persistent memory leak
High 8.2
CVE-2023-23631
HAMT Decoding Panics in github.com/ipfs/go-unixfsnode
Medium 5.9
CVE-2023-23626
Denial of service when feeding malformed size arguments in go-bitfield
Medium 5.9
CVE-2023-23625
Denial of service in HAMT Decoding in go-unixfs
Medium 5.9
CVE-2022-23495
ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag
High 7.5

Affected Vendor

Affected Software

go-ipfs
Vulnerable Versions:
< 0.8.0-rc1

Timeline

Official Publish: March 24th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact