or as-go Symlink-Chain Escape (GHSA-W3T7-QJ27-pjw) Analysis & POC

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Type: Symlink Chain Escape (symlink-chain escape) Vulnerability Description: When processes a tar archive, a maliciously crafted tar file may include a symlink pointing to an absolute path outside the storage working directory. When a subsequent regular file with the same name is written through this symlink, the file is written outside the working directory, resulting in a path traversal. Trigger Conditions: The tar file first writes a symlink (e.g., pointing to ), and then writes a regular file (e.g., ). The write operation traverses outside the working directory. Scope of Impact Affected Components: and (logic related to ) in the repository. Affected Versions: Unfixed versions prior to commit (before v2.6.2). Consequences: Files written may land outside the storage working directory, leading to path traversal that could affect other parts of the file system. Remediation Remove any pre-existing terminal symlink before writing the regular file. Added regression test to reproduce the symlink chain escape scenario. Fix commit: , author TerryHowe, signed as . POC / Exploit Code (Full Extraction) 1. Regression Test (Reproducing Symlink Chain Escape) 2. Fixed Write Logic ( ) 3. Key Fix Point (Symlink Check in ) Notes The fix blocks directory traversal caused by symlink chains by using to detect and remove any pre-existing terminal symlink before writing the regular file. The regression test fully reproduces the attack path of GHSA-W3T7-QJ27-pjw.

Goal Reached Thanks to every supporter — we hit 100%!

or as-go Symlink-Chain Escape (GHSA-W3T7-QJ27-pjw) Analysis & POC

More from this source