Every CVE Search/ Get API key

CVE-2020-26279

Path traversal

7.7 HighFix available

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.70%Up 0.9 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.7

Path traversal

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Record
CVE-2020-26279
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2021-1239 7.7

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Record
EUVD-2021-1239
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-27pv-q55r-222g 7.7

Path traversal in github.com/ipfs/go-ipfs

Impact

It is currently possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when ipfs get is done on an affected DAG.

  1. The only affected command is ipfs get.
  2. The gateway is not affected.

Patches

Traversal fix patched in https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227 tar-utils patch applied to go-ipfs via https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2

Workarounds

Upgrade to go-ipfs 0.8 or later.

References

Binaries for the patched versions of go-ipfs are available on the IPFS distributions site, https://dist.ipfs.io/go-ipfs

For more information

If you have any questions or comments about this advisory:

Record
GHSA-27pv-q55r-222g
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 7.7

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Record
CVE-2020-26279
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0
5.5 MediumAV:N/AC:L/Au:S/C:N/I:P/A:P
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2020-26279 8.1

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Record
ALPINE-CVE-2020-26279
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-03
OSV 8.1

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Record
CVE-2020-26279
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVGHSA-27pv-q55r-222g 7.7

Path traversal in github.com/ipfs/go-ipfs

Impact

It is currently possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when ipfs get is done on an affected DAG.

  1. The only affected command is ipfs get.
  2. The gateway is not affected.

Patches

Traversal fix patched in https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227 tar-utils patch applied to go-ipfs via https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2

Workarounds

Upgrade to go-ipfs 0.8 or later.

References

Binaries for the patched versions of go-ipfs are available on the IPFS distributions site, https://dist.ipfs.io/go-ipfs

For more information

If you have any questions or comments about this advisory:

Record
GHSA-27pv-q55r-222g
CVSS 3.1
7.7 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVGO-2022-0779 No score

Path traversal in github.com/ipfs/go-ipfs

Path traversal in github.com/ipfs/go-ipfs

Record
GO-2022-0779
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/ipfs/go-ipfs
Go
 before 0.8.0
0.8.0
go-ipfs
Alpine:v3.13
 before 0.8.0-r0
0.8.0-r0
go-ipfs
Alpine:v3.14
 before 0.8.0-r0
0.8.0-r0
go-ipfs
Alpine:v3.15
 before 0.8.0-r0
0.8.0-r0
go-ipfs
Alpine:v3.16
 before 0.8.0-r0
0.8.0-r0
kubo
Alpine:v3.17
 before 0.8.0-r0
0.8.0-r0
kubo
Alpine:v3.18
 before 0.8.0-r0
0.8.0-r0
kubo
Alpine:v3.19
 before 0.8.0-r0
0.8.0-r0
kubo
Alpine:v3.20
 before 0.8.0-r0
0.8.0-r0
kubo
Alpine:v3.21
 before 0.8.0-r0
0.8.0-r0
kubo
Alpine:v3.22
 before 0.8.0-r0
0.8.0-r0
kubo
Alpine:v3.23
 before 0.8.0-r0
0.8.0-r0
kubo
Alpine:v3.24
 before 0.8.0-r0
0.8.0-r0

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-26279 is a high vulnerability (CVSS 7.7) in Ipfs Go-ipfs, published March 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. Fixed in github.com/ipfs/go-ipfs 0.8.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open