Every CVE Search/ Get API key

CVE-2020-36314

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other...

3.9 LowFix available

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.61%Unchanged since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 3.9

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

Record
CVE-2020-36314
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS 2.0
2.6 LowAV:L/AC:H/Au:N/C:N/I:P/A:P
Weakness
CWE-59
Updated
2026-11-02
CVE List No score

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

Record
CVE-2020-36314
Updated
2026-11-02
EUVDEUVD-2020-23856 No score

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

Record
EUVD-2020-23856
Updated
2026-11-03
GitHub AdvisoriesGHSA-xf7f-5p7r-xc3c 3.9

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other...

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

Record
GHSA-xf7f-5p7r-xc3c
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2020-36314 3.9

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

Record
ALPINE-CVE-2020-36314
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-03
OSV 3.9

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

Record
CVE-2020-36314
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2020-36314 3.9

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

Record
DEBIAN-CVE-2020-36314
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVRHSA-2021:4179 3.9

Red Hat Security Advisory: file-roller security update

Record
RHSA-2021:4179
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVRLSA-2021:4179 3.9

Low: file-roller security update

File Roller is an application for creating and viewing archives files, such as tar or zip files.

Security Fix(es):

  • file-roller: directory traversal via directory symlink pointing outside of the target directory (incomplete fix for CVE-2020-11736) (CVE-2020-36314)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Record
RLSA-2021:4179
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2020-36314 3.9

fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.

Record
UBUNTU-CVE-2020-36314
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVALSA-2021:4179 No score

Low: file-roller security update

File Roller is an application for creating and viewing archives files, such as tar or zip files.

Security Fix(es):

  • file-roller: directory traversal via directory symlink pointing outside of the target directory (incomplete fix for CVE-2020-11736) (CVE-2020-36314)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:4179
Updated
2026-11-02
OSVCLSA-2022-1643124469 No score

Fix of CVE: CVE-2020-36314

  • CVE-2020-36314: Fix a path traversal vulnerability (#1947534)
Record
CLSA-2022-1643124469
Updated
2026-11-02
OSVMGASA-2021-0311 No score

Updated file-roller packages fix security vulnerability

Updated file-roller package fixes security vulnerability:

A path traversal vulnerability was found in file-roller due to an incomplete fix for CVE-2020-11736. It may still be possible to extract files outside of the intended directory in case of malicious archives containing symbolic links. The highest threat from this vulnerability is to data integrity and system availability (CVE-2020-36314).

Also, the patch for CVE-2020-11736 was not applied correctly in the previous update for Mageia 7 (MGASA-2020-0218). This has been corrected.

Record
MGASA-2021-0311
Updated
2026-11-02
OSVopenSUSE-SU-2024:10756-1 No score

file-roller-3.40.0-3.2 on GA media

These are all security issues fixed in the file-roller-3.40.0-3.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10756-1
Updated
2026-11-02
OSVSUSE-SU-2025:0032-1 No score

Security update for file-roller

This update for file-roller fixes the following issues:

  • CVE-2020-36314: Fixed directory traversal via directory symlink pointing outside of the target directory (bsc#1189131)
Record
SUSE-SU-2025:0032-1
Updated
2026-11-02
OSVUSN-4927-1 No score

file-roller vulnerability

It was discovered that File Roller incorrectly handled symlinks. An attacker could possibly use this issue to expose sensitive information.

Record
USN-4927-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
file-roller
Alpine:v3.13
 before 3.38.0-r1
3.38.0-r1
file-roller
AlmaLinux:8
From an advisory covering 2 CVEs
 before 3.28.1-4.el8
3.28.1-4.el8
file-roller
TuxCare:CentOS:8.4
 before 3.28.1-3.el8.4.tuxcare.els1
3.28.1-3.el8.4.tuxcare.els1
file-roller
Debian:12
 before 3.38.1-1
3.38.1-1
file-roller
Debian:13
 before 3.38.1-1
3.38.1-1
file-roller
Debian:14
 before 3.38.1-1
3.38.1-1
file-roller
Mageia:7
 before 3.32.1-2.2.mga7
3.32.1-2.2.mga7
file-roller
Mageia:8
 before 3.38.0-1.1.mga8
3.38.0-1.1.mga8
file-roller
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.1-4.el8
0:3.28.1-4.el8
file-roller-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.1-4.el8
0:3.28.1-4.el8
Show 7 moreShow less
Affected packages
PackageAffectedFixed
file-roller-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.28.1-4.el8
0:3.28.1-4.el8
file-roller
Rocky Linux:8
 before 0:3.28.1-4.el8
0:3.28.1-4.el8
file-roller
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 3.20.3-15.9.1
3.20.3-15.9.1
file-roller
Ubuntu:16.04:LTS
 before 3.16.5-0ubuntu1.5, plus listed versions
3.16.4-1ubuntu33.16.5-0ubuntu13.16.5-0ubuntu1.13.16.5-0ubuntu1.23.16.5-0ubuntu1.33.16.5-0ubuntu1.4
3.16.5-0ubuntu1.5
file-roller
Ubuntu:18.04:LTS
 before 3.28.0-1ubuntu1.3, plus listed versions
3.26.1-0ubuntu13.26.2-0ubuntu13.26.2-3ubuntu13.28.0-1ubuntu13.28.0-1ubuntu1.13.28.0-1ubuntu1.2
3.28.0-1ubuntu1.3
file-roller
Ubuntu:20.04:LTS
 before 3.36.3-0ubuntu1.1, plus listed versions
3.32.2-13.32.3-13.35.90-13.35.91-13.35.92-1
Show 5 moreShow less
3.36.0-13.36.1-13.36.1-1ubuntu0.13.36.2-0ubuntu13.36.3-0ubuntu1
3.36.3-0ubuntu1.1
file-roller
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 3.40.0-3.2
3.40.0-3.2

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36314 is a low vulnerability (CVSS 3.9) in Gnome File-roller, published April 7, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in file-roller 3.38.0-r1.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open