{"id":"CVE-2021-26719","aliases":["EUVD-2021-13507","GHSA-pj4h-x8qh-45r9","UBUNTU-CVE-2021-26719"],"status":"published","title":"A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent...","description":"A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01371,"percentile":0.72343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2021-02-09T13:43:49Z","modified":"2026-10-17T12:57:11Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5-3","2.7-1","2.7-2","2.7-3","2.10-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.1-3build2","3.2.1-4","3.2.1-5","3.4.1-4","3.4.1-6","3.4.1-7ubuntu1","4.4.1-5ubuntu2~18.04","4.4.1-5ubuntu2~18.04+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-8","4.4.1-9","4.4.1-10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-13"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-18","4.4.1-20"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-22"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-22ubuntu1","4.4.1-23"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"gradle","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.4.1-22","4.4.1-22build1","4.4.1-22ubuntu1"]}],"products":[{"vendor":"gradle","product":"enterprise_test_distribution_agent"},{"vendor":"gradle","product":"maven"},{"vendor":"gradle","product":"test_distribution"}],"references":[{"url":"https://security.gradle.com/advisory/CVE-2021-26719","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26719"},{"url":"https://github.com/advisories/GHSA-pj4h-x8qh-45r9"},{"url":"https://ubuntu.com/security/CVE-2021-26719","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-26719","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-26719","description":"A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations.","status":"published","published":"2021-02-09T13:43:49Z","modified":"2024-08-03T20:33:40.821Z","updated_at":"2026-11-02T14:32:57.033395Z"}],"euvd":[{"id":"EUVD-2021-13507","description":"A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations.","status":"published","published":"2021-02-09T13:43:49Z","modified":"2024-08-03T20:33:40Z","updated_at":"2026-11-03T03:24:50.84326Z"}],"ghsa":[{"id":"GHSA-pj4h-x8qh-45r9","title":"A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent...","description":"A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations.","status":"published","published":"2022-05-24T17:41:38Z","modified":"2023-01-29T05:06:27Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:46:01.439998Z"}],"nvd":[{"id":"CVE-2021-26719","description":"A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations.","status":"published","published":"2021-02-09T14:15:17.577Z","modified":"2026-06-17T03:43:43.18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"UBUNTU-CVE-2021-26719","description":"A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension before 1.8.2. A malicious actor (with certain credentials) can perform a registration step such that crafted TAR archives lead to extraction of files into arbitrary filesystem locations.","status":"published","published":"2021-02-09T14:15:00Z","modified":"2026-10-17T12:57:11.988520732Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"}]}}