CVE-2020-15121

In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory.

• CWE-78
• CWE-78

• https://github.com/radareorg/radare2/commit/04edfa82c1f3fa2bc3621ccdad2f93bdbf00e4f9Patch, Third Party Advisory
• https://github.com/radareorg/radare2/issues/16945Third Party Advisory
• https://github.com/radareorg/radare2/pull/16966Third Party Advisory
• https://github.com/radareorg/radare2/security/advisories/GHSA-r552-vp94-9358Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWC7KNBETYE5MK6VIUU26LUIISIFGSBZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YE77P5RSE2T7JHEKMWF2ARTSJGMPXCFY/
• https://github.com/radareorg/radare2/commit/04edfa82c1f3fa2bc3621ccdad2f93bdbf00e4f9Patch, Third Party Advisory
• https://github.com/radareorg/radare2/issues/16945Third Party Advisory
• https://github.com/radareorg/radare2/pull/16966Third Party Advisory
• https://github.com/radareorg/radare2/security/advisories/GHSA-r552-vp94-9358Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MWC7KNBETYE5MK6VIUU26LUIISIFGSBZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YE77P5RSE2T7JHEKMWF2ARTSJGMPXCFY/

Published

Jul 20, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15115etcd before versions 3.3.23 and 3.4.10 does not perform any …7.5
• CVE-2020-15117In Synergy before version 1.12.0, a Synergy server can be cr…6.5
• CVE-2020-15118In Wagtail before versions 2.7.4 and 2.9.3, when a form page…5.4
• CVE-2020-15119In auth0-lock versions before and including 11.25.1, dangero…5.4
• CVE-2020-1512An information disclosure vulnerability exists when the Wind…7.8
• CVE-2020-15120In "I hate money" before version 4.1.5, an authenticated mem…4.9
• CVE-2020-15123In codecov (npm package) before version 3.7.1 the upload met…9.3
• CVE-2020-15124In Goobi Viewer Core before version 4.8.3, a path traversal …6.5
• CVE-2020-15125In auth0 (npm package) versions before 2.27.1, a DenyList of…7.7
• CVE-2020-15126In parser-server from version 3.5.0 and before 4.3.0, an aut…6.5
• CVE-2020-15127In Contour ( Ingress controller for Kubernetes) before versi…7.5
• CVE-2020-15128In OctoberCMS before version 1.0.468, encrypted cookie value…6.3