{"id":"CVE-2020-9479","aliases":["EUVD-2020-30296","GHSA-j3f6-5wcm-3v96"],"status":"published","title":"unzip directory traversal","description":"When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01977,"percentile":0.80647,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2021-03-01T15:55:12Z","modified":"2026-10-24T10:30:52Z","products":[{"vendor":"apache","product":"asterixdb"},{"vendor":"apache software foundation","product":"apache asterixdb"}],"references":[{"url":"https://www.openwall.com/lists/oss-security/2020/08/08/2","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r4cc9cc9c54573babf821c31d5d410fb260d1cd416dc1b225d587be9b%40%3Cdev.asterixdb.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9479"},{"url":"https://lists.apache.org/thread.html/r4cc9cc9c54573babf821c31d5d410fb260d1cd416dc1b225d587be9b@%3Cdev.asterixdb.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-j3f6-5wcm-3v96"}],"sources":{"cve":[{"id":"CVE-2020-9479","title":"unzip directory traversal","description":"When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB","status":"published","published":"2021-03-01T15:55:12Z","modified":"2025-02-13T16:27:44.434Z","updated_at":"2026-11-02T14:35:49.209579Z"}],"euvd":[{"id":"EUVD-2020-30296","description":"When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB","status":"published","published":"2021-03-01T15:55:12Z","modified":"2025-02-13T16:27:44Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"none"}],"updated_at":"2026-11-03T00:03:53.290549Z"}],"ghsa":[{"id":"GHSA-j3f6-5wcm-3v96","title":"When loading a UDF, a specially crafted zip file could allow files to be placed outside of the...","description":"When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB","status":"published","published":"2022-05-24T17:43:24Z","modified":"2023-01-29T05:05:53Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:45:54.221809Z"}],"nvd":[{"id":"CVE-2020-9479","description":"When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB","status":"published","published":"2021-03-01T16:15:12.917Z","modified":"2026-06-17T03:28:01.263Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"CVE-2020-9479","description":"When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB","status":"published","published":"2021-03-01T16:15:12.917Z","modified":"2026-10-24T10:30:52.53540475Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.663289Z"}]}}