CVEs-PoC/2020/CVE-2020-12265.md

CVE-2020-12265

Description

The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.

POC

Reference

• https://github.com/kevva/decompress/issues/71
• https://github.com/kevva/decompress/pull/73

Github

• https://github.com/ossf-cve-benchmark/CVE-2020-12265