Описание
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.
Ссылки
EPSS
Процентиль: 36%
0.0042
Низкий
8.8 High
CVSS3
Дефекты
CWE-22
Связанные уязвимости
CVSS3: 8.8
github
4 дня назад
DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.
EPSS
Процентиль: 36%
0.0042
Низкий
8.8 High
CVSS3
Дефекты
CWE-22