CVE-2020-23172
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in...
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives.
- Record
CVE-2020-23172- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives.
- Record
CVE-2020-23172- Updated
- 2026-11-02
EUVDEUVD-2020-15925 No score
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives.
- Record
EUVD-2020-15925- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qp9p-388h-gp24 No score
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in...
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives.
- Record
GHSA-qp9p-388h-gp24- Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-23172 is a medium vulnerability (CVSS 5.5) in Kuba Project Kuba, published August 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. No source names a fixed version.