{"id":"CVE-2020-12265","aliases":["EUVD-2020-1238","GHSA-qgfr-5hqp-vrw9","ROOT-APP-NPM-CVE-2020-12265"],"status":"published","title":"Path Traversal in decompress","description":"The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02116,"percentile":0.81992,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-59"],"published":"2020-04-26T16:46:21Z","modified":"2026-10-20T10:51:46Z","fixes":[{"ecosystem":"npm","package":"decompress","fixed_in":["4.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"decompress","fixed_in":["4.2.1-aikido.1","4.2.1-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/decompress","fixed_in":["4.2.1-root.io.1","4.2.1-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1"}]}]},{"source":"osv","ecosystem":"npm","package":"decompress","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.2.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-aikido.1"},{"fixed":"4.2.1-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/decompress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-root.io.1"},{"fixed":"4.2.1-root.io.2"}]}]}],"products":[{"vendor":"decompress_project","product":"decompress"}],"references":[{"url":"https://www.npmjs.com/advisories/1217","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/kevva/decompress/issues/71","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/kevva/decompress/pull/73","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12265","tags":["advisory"]},{"url":"https://github.com/kevva/decompress/commit/967146e70f48be32ed1a69daa3941d681944d513","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qgfr-5hqp-vrw9"},{"url":"https://github.com/kevva/decompress","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-12265","description":"The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.","status":"published","published":"2020-04-26T16:46:21Z","modified":"2024-08-04T11:48:58.593Z","updated_at":"2026-11-02T14:35:52.925152Z"}],"euvd":[{"id":"EUVD-2020-1238","description":"The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.","status":"published","published":"2020-04-26T16:46:21Z","modified":"2024-08-04T11:48:58Z","updated_at":"2026-11-03T03:07:41.399649Z"}],"ghsa":[{"id":"GHSA-qgfr-5hqp-vrw9","title":"Path Traversal in decompress","description":"Versions of `decompress` prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing`../`.\n\n\n## Recommendation\n\nUpgrade to version 4.2.1 or later.","status":"published","published":"2020-09-03T21:16:27Z","modified":"2023-04-18T14:49:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:36:51.39133Z"}],"nvd":[{"id":"CVE-2020-12265","description":"The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.","status":"published","published":"2020-04-26T17:15:11.15Z","modified":"2026-06-17T02:51:31.937Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T14:05:59.718774Z"}],"osv":[{"id":"CVE-2020-12265","description":"The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.","status":"published","published":"2020-04-26T17:15:11.15Z","modified":"2026-10-20T10:51:46.352688371Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"GHSA-qgfr-5hqp-vrw9","title":"Path Traversal in decompress","description":"Versions of `decompress` prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing`../`.\n\n\n## Recommendation\n\nUpgrade to version 4.2.1 or later.","status":"published","published":"2020-09-03T21:16:27Z","modified":"2023-11-08T04:02:09.64557Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22","CWE-59"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"ROOT-APP-NPM-CVE-2020-12265","title":"CVE-2020-12265 in decompress - Patched by Root","description":"Root has patched CVE-2020-12265 in the decompress package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-06T10:38:45Z","modified":"2026-10-06T11:15:07.707268628Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}