MediumCVSS 5.0
EPSS 0.28%
libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive.
Product
KDE ark vulnerabilities
5 published CVES affecting KDE ark, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 5
- Critical
- 0
- High
- 1
- Medium
- 2
- Low
- 2
- Unscored
- 0
- CISA KEV
- 0
Latest KDE ark CVEs
Newest publication first
-
-
LowCVSS 3.3 EPSS 1.5%
In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a write operation to a user's home directory.
-
LowCVSS 3.3 EPSS 1.7%
In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted archive can install files outside the extraction directory via ../ directory traversal.
-
HighCVSS 7.8 EPSS 3.1%
ark before 16.12.1 might allow remote attackers to execute arbitrary code via an executable in an archive, related to associated applications.
-
MediumCVSS 6.8 EPSS 3.0%
Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. (dot dot) sequences in a zip file.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.