{"id":"CVE-2024-1485","aliases":["GHSA-84xv-jfrm-h4gm","GO-2024-2576"],"title":"registry-support: decompress can delete files outside scope via relative paths","summary":"registry-support: decompress can delete files outside scope via relative paths","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H","vendor":"devfile","product":"github.com/devfile/registry-support/registry-library","ecosystem":"go","affected":["github.com/devfile/registry-support/registry-library < 0.0.0-20240206"],"patched":["github.com/devfile/registry-support/registry-library 0.0.0-20240206"],"published":"2024-02-14","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:05.457573639Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-84xv-jfrm-h4gm","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1485"},{"url":"https://github.com/devfile/registry-support/pull/197"},{"url":"https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d"},{"url":"https://access.redhat.com/security/cve/CVE-2024-1485"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264106"},{"url":"https://github.com/advisories/GHSA-84xv-jfrm-h4gm"},{"url":"https://github.com/devfile/registry-support"}],"tags":["osv","go"],"epss":0.00942,"epssPercentile":0.59527,"ingestedAt":"2026-07-09T18:56:36.217Z","slug":"CVE-2024-1485","body":"## Overview\n\nA vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.\n\n## Affected packages\n\n- `github.com/devfile/registry-support/registry-library < 0.0.0-20240206`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/devfile/registry-support/registry-library 0.0.0-20240206`","depth":"twilight","depthScore":44,"depthScoreParts":{"impact":44,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}