{"id":"CVE-2020-16116","aliases":["ALPINE-CVE-2020-16116","DEBIAN-CVE-2020-16116","DLA-3015-1","DSA-4738-1","EUVD-2020-8082","GHSA-2q6p-c398-62rm","MGASA-2020-0323","UBUNTU-CVE-2020-16116","USN-4461-1","openSUSE-SU-2020:1183-1","openSUSE-SU-2020:1183-2","openSUSE-SU-2024:10632-1"],"status":"published","title":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the...","description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01706,"percentile":0.77489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2020-07-31T00:00:00Z","modified":"2026-11-03T06:32:24Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"ark","fixed_in":["20.04.2-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"ark","fixed_in":["20.04.3-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"ark","fixed_in":["4:20.04.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ark","fixed_in":["4:20.04.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ark","fixed_in":["4:20.04.3-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ark","fixed_in":["4:18.08.3-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"ark","fixed_in":["19.04.0-1.1.mga7"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ark","fixed_in":["4:17.12.3-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ark","fixed_in":["4:19.12.3-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"ark","fixed_in":["20.04.2-bp152.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP2","package":"ark","fixed_in":["20.04.2-bp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"ark","fixed_in":["20.04.2-bp152.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"ark","fixed_in":["20.04.2-bp152.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.2-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.3-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:20.04.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:20.04.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:20.04.3-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:16.08.3-2+deb9u1"}]}],"versions":["4:16.08.3-2"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:18.08.3-1+deb10u1"}]}],"versions":["4:18.08.3-1"]},{"source":"osv","ecosystem":"Mageia:7","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.04.0-1.1.mga7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4:15.08.2-0ubuntu1","4:15.12.1-0ubuntu1","4:15.12.3-0ubuntu1","4:15.12.3-0ubuntu1.1","4:15.12.3-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:17.12.3-0ubuntu1.1"}]}],"versions":["4:17.04.3-0ubuntu3","4:17.08.3-0ubuntu1","4:17.08.3-0ubuntu2","4:17.12.2-0ubuntu1","4:17.12.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:19.12.3-0ubuntu1.1"}]}],"versions":["4:19.04.3-0ubuntu2","4:19.08.1-1","4:19.08.3-0ubuntu1","4:19.12.0-0ubuntu1","4:19.12.0-1","4:19.12.1-0ubuntu1","4:19.12.2-0ubuntu1","4:19.12.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:17.12.3-0ubuntu1.1"}]}],"versions":["4:17.04.3-0ubuntu3","4:17.08.3-0ubuntu1","4:17.08.3-0ubuntu2","4:17.12.2-0ubuntu1","4:17.12.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:19.12.3-0ubuntu1.1"}]}],"versions":["4:19.04.3-0ubuntu2","4:19.08.1-1","4:19.08.3-0ubuntu1","4:19.12.0-0ubuntu1","4:19.12.0-1","4:19.12.1-0ubuntu1","4:19.12.2-0ubuntu1","4:19.12.3-0ubuntu1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP2","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.04.2-bp152.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.08.1-1.2"}]}],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"kde","product":"ark"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://github.com/KDE/ark/commits/master","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2020/dsa-4738","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://kde.org/info/security/advisory-20200730-1.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://invent.kde.org/utilities/ark/-/commit/0df592524fed305d6fbe74ddf8a196bc9ffdb92f","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://security.gentoo.org/glsa/202008-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYRKQKUVU45ANH5TFYCYZN6HVP34N3UL/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00023.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMVXSQNCBILVSJLX32ODNU6KUY2X7HRM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4461-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/05/msg00026.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16116"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PMVXSQNCBILVSJLX32ODNU6KUY2X7HRM/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYRKQKUVU45ANH5TFYCYZN6HVP34N3UL/"},{"url":"https://github.com/advisories/GHSA-2q6p-c398-62rm"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-16116","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-16116","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0323.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27023","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-16116","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4461-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-16116","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/N3NNW42DFGLFOOTXLOJI72ESGDSBHATP/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174773","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16116","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RZCP2FRO5N22JWDXQKAEOIHUG2LFWJNH/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24654","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-16116","description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","status":"published","published":"2020-08-03T19:34:07Z","modified":"2024-08-04T13:37:53.926Z","updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2020-8082","description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","status":"published","published":"2020-08-03T19:34:07Z","modified":"2024-08-04T13:37:53Z","updated_at":"2026-11-03T03:07:29.271552Z"}],"ghsa":[{"id":"GHSA-2q6p-c398-62rm","title":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the...","description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","status":"published","published":"2022-05-24T17:24:52Z","modified":"2023-01-29T05:04:02Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:45:27.507739Z"}],"nvd":[{"id":"CVE-2020-16116","description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","status":"published","published":"2020-08-03T20:15:13.98Z","modified":"2026-06-17T02:57:43.953Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"ALPINE-CVE-2020-16116","description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","status":"published","published":"2020-08-03T20:15:13.98Z","modified":"2026-11-03T06:32:24.189663252Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T07:17:57.723967Z"},{"id":"CVE-2020-16116","description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","status":"published","published":"2020-08-03T20:15:13.98Z","modified":"2026-10-24T10:51:20.526102743Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-16116","description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","status":"published","published":"2020-08-03T20:15:13.98Z","modified":"2026-10-26T12:02:28.614478136Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-16116","description":"In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.","status":"published","published":"2020-08-03T20:15:00Z","modified":"2026-02-04T03:27:27.184851Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-3015-1","title":"ark - security update","status":"published","published":"2022-05-20T00:00:00Z","modified":"2026-03-09T01:20:17.369446Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-4738-1","title":"ark - security update","status":"published","published":"2020-07-31T00:00:00Z","modified":"2026-03-09T02:09:55.27657Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0323","title":"Updated ark packages fix security vulnerability","description":"A maliciously crafted archive with \"../\" in the file paths would install files\nanywhere in the user's home directory upon extraction (CVE-2020-16116).\n","status":"published","published":"2020-08-18T17:41:27Z","modified":"2026-04-16T04:44:37.455466737Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:1183-1","title":"Security update for ark","description":"This update for ark fixes the following issues:\n\n- Fixed a directory traversal bug (boo#1174773, CVE-2020-16116).\n","status":"published","published":"2020-08-12T08:29:36Z","modified":"2026-02-04T03:11:01.446171Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2020:1183-2","title":"Security update for ark","description":"This update for ark fixes the following issues:\n\n- Fixed a directory traversal bug (boo#1174773, CVE-2020-16116).\n","status":"published","published":"2020-08-12T08:29:36Z","modified":"2026-02-04T03:41:55.076146Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2024:10632-1","title":"ark-21.08.1-1.2 on GA media","description":"These are all security issues fixed in the ark-21.08.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:57:58.496731Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"USN-4461-1","title":"ark vulnerability","description":"Dominik Penner discovered that Ark did not properly sanitize zip archive\nfiles before performing extraction. An attacker could use this to construct\na malicious zip archive that, when opened, would create files outside the\nextraction directory.\n","status":"published","published":"2020-08-18T04:13:22Z","modified":"2026-04-27T15:40:26.712981Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}