{"cve":"CVE-2020-27833","nvd":{"published":"2021-05-14T21:15:07.363","modified":"2026-06-17T03:09:42.433","status":"Modified","description":"A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image (.tar file) which contains symbolic links. The vulnerability is limited to the command `oc image extract`. If a symbolic link is first created pointing within the tarball, this allows further symbolic links to bypass the existing path check. This flaw allows the tarball to create links outside the tarball's parent directory, allowing for executables or configuration files to be overwritten, resulting in arbitrary code execution. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions up to and including openshift-clients-4.7.0-202104250659.p0.git.95881af are affected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","score":7.1},"cwes":["CWE-59","CWE-20"],"references":["https://access.redhat.com/security/cve/CVE-2020-27833","https://bugzilla.redhat.com/show_bug.cgi?id=1905945","https://access.redhat.com/security/cve/CVE-2020-27833","https://bugzilla.redhat.com/show_bug.cgi?id=1905945"],"products":["redhat:openshift_container_platform"],"source":"nvd","synced_at":"2026-10-19T21:18:09.669877188+00:00"},"epss":{"cve":"CVE-2020-27833","score":0.01664,"percentile":0.76717,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}