CVE-2021-34363
The Fuck Arbitrary File Deletion via Path Traversal
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
- Record
CVE-2021-34363- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
CVE List No score
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
- Record
CVE-2021-34363- Updated
- 2026-11-02
EUVDEUVD-2021-0453 No score
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
- Record
EUVD-2021-0453- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8wwf-2644-f8x4
The Fuck Arbitrary File Deletion via Path Traversal
The thefuck (aka The Fuck) is app that corrects errors in previous console commands. The Fuck python package before 3.31 allows Path Traversal that leads to arbitrary file deletion via the undo archive operation feature.
- Record
GHSA-8wwf-2644-f8x4- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
- Record
CVE-2021-34363- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-34363
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
- Record
DEBIAN-CVE-2021-34363- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-8wwf-2644-f8x4
The Fuck Arbitrary File Deletion via Path Traversal
The thefuck (aka The Fuck) is app that corrects errors in previous console commands. The Fuck python package before 3.31 allows Path Traversal that leads to arbitrary file deletion via the undo archive operation feature.
- Record
GHSA-8wwf-2644-f8x4- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-34363
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
- Record
UBUNTU-CVE-2021-34363- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2021-97 No score
The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive operation" feature.
- Record
PYSEC-2021-97- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thefuckPyPI |
before 3.31 | 3.31 |
thefuckDebian:12 |
before 3.29-0.3 | 3.29-0.3 |
thefuckDebian:13 |
before 3.29-0.3 | 3.29-0.3 |
thefuckDebian:14 |
before 3.29-0.3 | 3.29-0.3 |
thefuckPyPI |
before 3.31, plus listed versions 0.111.01.11.11 Show 45 moreShow less1.121.131.141.151.161.171.181.191.21.201.211.221.231.261.271.281.291.31.301.311.321.331.341.351.361.371.381.391.41.401.411.421.431.441.451.461.471.481.491.49.11.51.61.71.81.9 |
3.31 |
thefuckUbuntu:16.04:LTS |
All versions, plus listed versions 2.5.6-13.2-1 |
None known |
thefuckUbuntu:18.04:LTS |
All versions, plus listed versions 3.11-2 |
None known |
thefuckUbuntu:20.04:LTS |
All versions, plus listed versions 3.29-0.1 |
None known |
thefuckUbuntu:22.04:LTS |
All versions, plus listed versions 3.29-0.3 |
None known |
thefuckUbuntu:24.04:LTS |
All versions, plus listed versions 3.29-0.33.29-0.3ubuntu1 |
None known |
thefuckUbuntu:25.10 |
All versions, plus listed versions 3.32-0.23.32-0.33.32-0.4 |
None known |
thefuckUbuntu:26.10 |
All versions, plus listed versions 3.32-0.43.32-0.5 |
None known |
thefuckUbuntu:26.04:LTS |
All versions, plus listed versions 3.32-0.4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-34363 is a critical vulnerability (CVSS 9.1) in The Fuck Project Fuck, published June 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in thefuck 3.31.
References
github.com/nvbn/thefuck/releases/tag/3.31
vuln.ryotak.me/advisories/48
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4MEDDLBFVRUQHPYIBJ4MFM3M4NUJUXL5
nvd.nist.gov/vuln/detail/CVE-2021-34363
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2021-34363
ubuntu.com/security/CVE-2021-34363
cve.org/CVERecord?id=CVE-2021-34363
Left out here: 49 versions. The JSON record has them.