Product

debian/ark vulnerabilities

9 published CVES affecting debian/ark, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 9
Critical: 0
High: 1
Medium: 1
Low: 2
Unscored: 5
CISA KEV: 0

Latest debian/ark CVEs

Newest publication first

DSA-6029-1 ark - security update
Published 2025-10-20

Unknown
DLA-4046-1 ark - security update
Published 2025-02-08

Unknown
CVE-2024-57966 libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.
Published 2025-02-03

MediumCVSS 5.0 EPSS 0.28%

libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.
DLA-3015-1 ark - security update
Published 2022-05-20

Unknown
DSA-4759-1 ark - security update
Published 2020-09-04

Unknown
CVE-2020-24654 In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.
Published 2020-09-02

LowCVSS 3.3 EPSS 1.5%

In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.
CVE-2020-16116 In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.
Published 2020-08-03

LowCVSS 3.3 EPSS 1.7%

In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.
DSA-4738-1 ark - security update
Published 2020-07-31

Unknown
CVE-2017-5330 ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.
Published 2017-03-27

HighCVSS 7.8 EPSS 3.1%

ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.