CVE Feed

    Dashboard / CVE / CVE-2020-36561

    CVE-2020-36561

    Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

    Published:Dec 27, 2022
    Last Modified:Apr 11, 2025
    EPS:Dec 27, 2022
    EPSS Score:0.00125
    CVSS Score:9.1

    Affected Products

    Vendor
    Unzip Project
    Product
    Unzip

    Exploits

    https://github.com/yi-ge/unzip/pull/1https://github.com/yi-ge/unzip/pull/1

    Related CVEs

    CVE-2022-0530 (CVSS 5.5) — A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string t…
    CVE-2022-0529 (CVSS 5.5) — A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string t…
    CVE-2021-4217 (CVSS 3.3) — A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lea…
    CVE-2019-13232 (CVSS 3.3) — Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (r…
    CVE-2018-18384 (CVSS 5.5) — Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the …
    CVE-2018-1000035 (CVSS 7.8) — A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected …
    CVE-2016-9844 (CVSS 4) — Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a…
    CVE-2015-7696 (CVSS 6.8) — Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and appli…
    CVE-2015-7697 (CVSS 4.3) — Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data i…
    CVE-2014-8139 (CVSS 7.8) — Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High