---
id: CVE-2024-1485
aliases:
  - GHSA-84xv-jfrm-h4gm
  - GO-2024-2576
title: 'registry-support: decompress can delete files outside scope via relative paths'
summary: 'registry-support: decompress can delete files outside scope via relative paths'
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H'
vendor: devfile
product: github.com/devfile/registry-support/registry-library
ecosystem: go
affected:
  - github.com/devfile/registry-support/registry-library < 0.0.0-20240206
patched:
  - github.com/devfile/registry-support/registry-library 0.0.0-20240206
published: '2024-02-14'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:05.457573639Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-84xv-jfrm-h4gm'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-1485'
  - url: 'https://github.com/devfile/registry-support/pull/197'
  - url: >-
      https://github.com/devfile/registry-support/commit/0e44b9ca6d03fac4fc3f77d37656d56dc5defe0d
  - url: 'https://access.redhat.com/security/cve/CVE-2024-1485'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2264106'
  - url: 'https://github.com/advisories/GHSA-84xv-jfrm-h4gm'
  - url: 'https://github.com/devfile/registry-support'
tags:
  - osv
  - go
epss: 0.00942
epssPercentile: 0.59527
ingestedAt: '2026-07-09T18:56:36.217Z'
---

## Overview

A vulnerability was found in the decompression function of registry-support. This issue can be triggered by an unauthenticated remote attacker when tricking a user into opening a specially modified .tar archive, leading to the cleanup process following relative paths to overwrite or delete files outside the intended scope.

## Affected packages

- `github.com/devfile/registry-support/registry-library < 0.0.0-20240206`

## Remediation

Upgrade to a patched release:

- `github.com/devfile/registry-support/registry-library 0.0.0-20240206`