CVE-2020-24654
ark: crafted TAR archive with symlinks can install files outside the extraction directory
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · August 27, 2020
Updated · November 22, 2025
Description
In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
The way to mitigate this flaw is to pay attention to the contents of the archive in ark before extracting, to ensure that there are no improper symlinks, and heed the file overwrite warnings.
CVSS / CWE
CVSS 3.1 · 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE-59 · Improper Link Resolution Before File Access ('Link Following')