CVE-2020-26279

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

• CWE-22

• https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2Patch, Third Party Advisory
• https://github.com/ipfs/go-ipfs/security/advisories/GHSA-27pv-q55r-222gThird Party Advisory
• https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227Patch, Third Party Advisory
• https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2Patch, Third Party Advisory
• https://github.com/ipfs/go-ipfs/security/advisories/GHSA-27pv-q55r-222gThird Party Advisory
• https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227Patch, Third Party Advisory

Published

Mar 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-26273osquery is a SQL powered operating system instrumentation, m…5.2
• CVE-2020-26274In systeminformation (npm package) before version 4.31.1 the…8.8
• CVE-2020-26275The Jupyter Server provides the backend (i.e. the core servi…6.1
• CVE-2020-26276Fleet is an open source osquery manager. In Fleet before ver…9.8
• CVE-2020-26277DBdeployer is a tool that deploys MySQL database servers eas…6.1
• CVE-2020-26278Weave Net is open source software which creates a virtual ne…8
• CVE-2020-2628Vulnerability in the Enterprise Manager Base Platform produc…6
• CVE-2020-26280OpenSlides is a free, Web-based presentation and assembly sy…8.9
• CVE-2020-26281async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates…7.5
• CVE-2020-26282BrowserUp Proxy allows you to manipulate HTTP requests and r…10
• CVE-2020-26283go-ipfs is an open-source golang implementation of IPFS whic…8.8
• CVE-2020-26284Hugo is a fast and Flexible Static Site Generator built in G…8.5