{"id":"CVE-2020-36314","aliases":["ALPINE-CVE-2020-36314","ALSA-2021:4179","CLSA-2022-1643124469","DEBIAN-CVE-2020-36314","EUVD-2020-23856","GHSA-xf7f-5p7r-xc3c","MGASA-2021-0311","RHSA-2021:4179","RLSA-2021:4179","SUSE-SU-2025:0032-1","UBUNTU-CVE-2020-36314","USN-4927-1","openSUSE-SU-2024:10756-1"],"status":"published","title":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other...","description":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00587,"percentile":0.48381,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-59"],"published":"2021-04-07T11:07:40Z","modified":"2026-11-03T06:32:46Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"file-roller","fixed_in":["3.38.0-r1"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"file-roller","fixed_in":["3.28.1-3.el8.4.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"file-roller","fixed_in":["3.38.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"file-roller","fixed_in":["3.38.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"file-roller","fixed_in":["3.38.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"file-roller","fixed_in":["3.32.1-2.2.mga7"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"file-roller","fixed_in":["3.38.0-1.1.mga8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"file-roller","fixed_in":["0:3.28.1-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"file-roller-debuginfo","fixed_in":["0:3.28.1-4.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"file-roller-debugsource","fixed_in":["0:3.28.1-4.el8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"file-roller","fixed_in":["0:3.28.1-4.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"file-roller","fixed_in":["3.20.3-15.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"file-roller","fixed_in":["3.16.5-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"file-roller","fixed_in":["3.28.0-1ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"file-roller","fixed_in":["3.36.3-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.0-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.1-4.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.1-3.el8.4.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.32.1-2.2.mga7"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.0-1.1.mga8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.1-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"file-roller-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.1-4.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"file-roller-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.1-4.el8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.1-4.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3-15.9.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.5-0ubuntu1.5"}]}],"versions":["3.16.4-1ubuntu3","3.16.5-0ubuntu1","3.16.5-0ubuntu1.1","3.16.5-0ubuntu1.2","3.16.5-0ubuntu1.3","3.16.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-1ubuntu1.3"}]}],"versions":["3.26.1-0ubuntu1","3.26.2-0ubuntu1","3.26.2-3ubuntu1","3.28.0-1ubuntu1","3.28.0-1ubuntu1.1","3.28.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.3-0ubuntu1.1"}]}],"versions":["3.32.2-1","3.32.3-1","3.35.90-1","3.35.91-1","3.35.92-1","3.36.0-1","3.36.1-1","3.36.1-1ubuntu0.1","3.36.2-0ubuntu1","3.36.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.5-0ubuntu1.5"}]}],"versions":["3.16.4-1ubuntu3","3.16.5-0ubuntu1","3.16.5-0ubuntu1.1","3.16.5-0ubuntu1.2","3.16.5-0ubuntu1.3","3.16.5-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0-1ubuntu1.3"}]}],"versions":["3.26.1-0ubuntu1","3.26.2-0ubuntu1","3.26.2-3ubuntu1","3.28.0-1ubuntu1","3.28.0-1ubuntu1.1","3.28.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.3-0ubuntu1.1"}]}],"versions":["3.32.2-1","3.32.3-1","3.35.90-1","3.35.91-1","3.35.92-1","3.36.0-1","3.36.1-1","3.36.1-1ubuntu0.1","3.36.2-0ubuntu1","3.36.3-0ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"file-roller","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.40.0-3.2"}]}],"bundled":2}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnome","product":"file-roller"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/file-roller/-/issues/108","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/file-roller/-/commit/e970f4966bf388f6e7c277357c8b186c645683ae","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KJBZVCHQ4SSX2JAJZVJ5J4P3GEMXJ75/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36314","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6KJBZVCHQ4SSX2JAJZVJ5J4P3GEMXJ75/"},{"url":"https://github.com/advisories/GHSA-xf7f-5p7r-xc3c"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-36314","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-4179.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-36314","tags":["report"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1643124469.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-36314","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0311.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29006","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/6KJBZVCHQ4SSX2JAJZVJ5J4P3GEMXJ75/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2020-0218.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4179","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1947534","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4179.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-36314","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-36314","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4179","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250032-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189131","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36314","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-36314","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4927-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11736","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-36314","description":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.","status":"published","published":"2021-04-07T11:07:40Z","modified":"2024-08-04T17:23:09.845Z","updated_at":"2026-11-02T14:35:55.128961Z"}],"euvd":[{"id":"EUVD-2020-23856","description":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.","status":"published","published":"2021-04-07T11:07:40Z","modified":"2024-08-04T17:23:09Z","updated_at":"2026-11-03T03:07:04.065361Z"}],"ghsa":[{"id":"GHSA-xf7f-5p7r-xc3c","title":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other...","description":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.","status":"published","published":"2022-05-24T17:46:45Z","modified":"2023-01-27T05:03:13Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:42:11.706998Z"}],"nvd":[{"id":"CVE-2020-36314","description":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.","status":"published","published":"2021-04-07T12:15:12.733Z","modified":"2026-06-17T03:15:17.227Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low","assessor":"primary"},{"version":"2.0","score":2.6,"vector":"AV:L/AC:H/Au:N/C:N/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"ALPINE-CVE-2020-36314","description":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.","status":"published","published":"2021-04-07T12:15:12.733Z","modified":"2026-11-03T06:32:46.210280237Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2020-36314","description":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.","status":"published","published":"2021-04-07T12:15:12.733Z","modified":"2026-10-24T14:47:22.692440673Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"DEBIAN-CVE-2020-36314","description":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.","status":"published","published":"2021-04-07T12:15:12.733Z","modified":"2026-10-26T12:02:49.160200248Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"RHSA-2021:4179","title":"Red Hat Security Advisory: file-roller security update","status":"published","published":"2024-09-16T05:44:43Z","modified":"2025-11-22T12:26:20Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4179","title":"Low: file-roller security update","description":"File Roller is an application for creating and viewing archives files, such as tar or zip files.\n\nSecurity Fix(es):\n\n* file-roller: directory traversal via directory symlink pointing outside of the target directory (incomplete fix for CVE-2020-11736) (CVE-2020-36314)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:32:50Z","modified":"2026-02-05T07:45:08.8374Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-36314","description":"fr-archive-libarchive.c in GNOME file-roller through 3.38.0, as used by GNOME Shell and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-11736.","status":"published","published":"2021-04-07T12:15:00Z","modified":"2026-02-04T03:41:51.369966Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"ALSA-2021:4179","title":"Low: file-roller security update","description":"File Roller is an application for creating and viewing archives files, such as tar or zip files.\n\nSecurity Fix(es):\n\n* file-roller: directory traversal via directory symlink pointing outside of the target directory (incomplete fix for CVE-2020-11736) (CVE-2020-36314)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:32:50Z","modified":"2026-10-29T11:01:09.403971959Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2022-1643124469","title":"Fix of CVE: CVE-2020-36314","description":"- CVE-2020-36314: Fix a path traversal vulnerability (#1947534)","status":"published","published":"2022-01-25T15:27:49Z","modified":"2026-06-01T00:33:19.123715454Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"MGASA-2021-0311","title":"Updated file-roller packages fix security vulnerability","description":"Updated file-roller package fixes security vulnerability:\n\nA path traversal vulnerability was found in file-roller due to an\nincomplete fix for CVE-2020-11736. It may still be possible to extract\nfiles outside of the intended directory in case of malicious archives\ncontaining symbolic links. The highest threat from this vulnerability\nis to data integrity and system availability (CVE-2020-36314).\n\nAlso, the patch for CVE-2020-11736 was not applied correctly in the\nprevious update for Mageia 7 (MGASA-2020-0218). This has been corrected.\n","status":"published","published":"2021-07-04T02:13:55Z","modified":"2026-04-16T04:42:41.455903579Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2024:10756-1","title":"file-roller-3.40.0-3.2 on GA media","description":"These are all security issues fixed in the file-roller-3.40.0-3.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:29:48.85136Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2025:0032-1","title":"Security update for file-roller","description":"This update for file-roller fixes the following issues:\n\n- CVE-2020-36314: Fixed directory traversal via directory symlink pointing outside of the target directory (bsc#1189131)\n","status":"published","published":"2025-01-07T16:38:44Z","modified":"2026-02-04T04:21:53.432287Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"USN-4927-1","title":"file-roller vulnerability","description":"It was discovered that File Roller incorrectly handled symlinks.\nAn attacker could possibly use this issue to expose sensitive information.\n","status":"published","published":"2021-04-26T13:09:52Z","modified":"2026-02-10T04:42:09Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}