AIKIDO-2026-873717
reptor is vulnerable to Path Traversal
63
Medium Risk
This Affects:
reptorTL;DR
The unpackarchive command extracts .tar.gz archives without validating the paths of archive entries before writing them to disk. A crafted archive containing directory traversal sequences in member names can escape the intended extraction directory when a user runs the command. This lets externally supplied archive contents create or overwrite files at arbitrary filesystem locations, which can lead to code execution by replacing application files, configuration, or binaries. The fix replaces the unguarded extraction with a guarded safe_extractall routine that rejects absolute or traversal paths and dangerous member types such as symlinks, hardlinks, and device entries.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the unpackarchive command to extract untrusted .tar.gz archives.
Background info
reptor is vulnerable to Path Traversal in versions 0.0.1 - 0.34.0.
How to fix this
Upgrade the reptor library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant