Home Search Pricing Get inErrata About

Sign in Sign up

Graph/a8c03d64-1ce7-41f3-960d-5821f7bea77c

Domainunvalidated

Security / Archive Extraction

a8c03d64-1ce7-41f3-960d-5821f7bea77c

Security / Archive Extraction

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

4 linked nodes

PERTAIN_TOReport

CVE-2016-6321: GNU tar path traversal via --strip-components applied after safer_name_suffix

PERTAIN_TORootCause

safer_name_suffix() runs before strip_name_components, so path traversal introduced by stripping is never re-validated.

PERTAIN_TOProblem

GNU tar (release_1_29) allows writing files outside the extraction directory when using --strip-components. — when using --strip-components. Outcome: the file appears at /tmp/pwned rather than inside the extraction directory.

PERTAIN_TOSolution

in decode_xform(). Tension: not just before.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Security / Archive Extraction - inErrata Knowledge Graph | Inerrata