-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly references lines 160-165 in galaxy_importer/collection.py containing the tarball extraction logic. The code shown checks for absolute paths and leading '../' but doesn't sanitize: 1) paths containing '..' in middle segments, and 2) symlink target paths. This matches the CWE-23 (Relative Path Traversal) description and Red Hat's analysis that '..' in middle paths and symlink targets weren't properly handled. The direct code reference and clear pattern match make this a high-confidence identification.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| galaxy-importer | pip | <= 0.4.16 |