{"id":"CVE-2023-32317","aliases":["EUVD-2023-36564","GHSA-h8g5-vhm4-wx6g"],"status":"published","title":"Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)","description":"Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both \"Base File Tar\" and \"Additional file archive\" can be fed with Tar files that contain paths outside their target directories (e.g.,  `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process.  This issue has been addressed in version 2.11.0. Users are advised to upgrade.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00887,"percentile":0.59731,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2023-05-26T22:42:09Z","modified":"2026-10-28T02:30:35Z","products":[{"vendor":"autolab","product":"autolab"},{"vendor":"autolabproject","product":"autolab"}],"references":[{"url":"https://github.com/autolab/Autolab/security/advisories/GHSA-h8g5-vhm4-wx6g","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/autolab/Autolab/commit/410a9228ee265f80692334d75eb2c3b4dac6f9e5","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://securitylab.github.com/advisories/GHSL-2023-081_GHSL-2023-082_Autolab/","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32317.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32317","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-32317","title":"Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)","description":"Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both \"Base File Tar\" and \"Additional file archive\" can be fed with Tar files that contain paths outside their target directories (e.g.,  `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process.  This issue has been addressed in version 2.11.0. Users are advised to upgrade.","status":"published","published":"2023-05-26T22:42:09.929Z","modified":"2024-08-02T15:10:24.879Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:29.381004Z"}],"euvd":[{"id":"EUVD-2023-36564","description":"Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both \"Base File Tar\" and \"Additional file archive\" can be fed with Tar files that contain paths outside their target directories (e.g.,  `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process.  This issue has been addressed in version 2.11.0. Users are advised to upgrade.","status":"published","published":"2023-05-26T22:42:09Z","modified":"2024-08-02T15:10:24Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T03:50:05.016714Z"}],"nvd":[{"id":"CVE-2023-32317","description":"Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both \"Base File Tar\" and \"Additional file archive\" can be fed with Tar files that contain paths outside their target directories (e.g.,  `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process.  This issue has been addressed in version 2.11.0. Users are advised to upgrade.","status":"published","published":"2023-05-26T23:15:16.95Z","modified":"2026-06-17T05:58:33.507Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"CVE-2023-32317","title":"Autolab tar slip in cheat checker functionality (`GHSL-2023-082`)","description":"Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted Tar file. Both \"Base File Tar\" and \"Additional file archive\" can be fed with Tar files that contain paths outside their target directories (e.g.,  `../../../../tmp/tarslipped2.sh`). When the MOSS cheat checker is started the files inside of the archives are expanded to the attacker-chosen locations. This issue may lead to arbitrary file write within the scope of the running process.  This issue has been addressed in version 2.11.0. Users are advised to upgrade.","status":"published","published":"2023-05-26T22:42:09.929Z","modified":"2026-10-28T02:30:35.863577827Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:31.790231Z"}]}}