{"affected":[{"product":"libarchive","source":"CNA: redhat","vendor":"n/a","versions":[{"status":"affected","version":"Fixed in libarchive 3.5.2"}]}],"cveId":"CVE-2021-31566","cwes":["CWE-59"],"description":"An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of the archive. An attacker may provide a malicious archive to a victim user, who would trigger this flaw when trying to extract the archive. A local attacker may use this flaw to gain more privileges in a system.","epss":{"date":"2026-11-02","percentile":0.33158,"score":0.0039},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793642534581,"publishedAt":1661212800000,"references":[{"source":"CNA: redhat","tags":[],"url":"https://github.com/libarchive/libarchive/issues/1566"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/libarchive/libarchive/commit/b41daecb5ccb4c8e3b2c53fd6147109fc12c3043"},{"source":"CNA: redhat","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024237"},{"source":"CNA: redhat","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2021-31566"},{"source":"CNA: redhat","tags":["mailing-list"],"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00030.html"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://github.com/libarchive/libarchive/issues/1566"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://github.com/libarchive/libarchive/commit/b41daecb5ccb4c8e3b2c53fd6147109fc12c3043"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2024237"},{"source":"ADP: CVE","tags":["x_transferred"],"url":"https://access.redhat.com/security/cve/CVE-2021-31566"},{"source":"ADP: CVE","tags":["mailing-list","x_transferred"],"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00030.html"}],"remediation":[],"revision":"7bbc73f362bc538c155bfa8e03366d0cb52522ddb0d89bcc990bfa7a8ab2261b","sources":[{"modifiedAt":1793642534581,"name":"CNA: redhat","retrievedAt":1793642927011,"url":"https://www.cve.org/CVERecord?id=CVE-2021-31566"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793642931273,"url":"https://api.first.org/data/v1/epss?cve=CVE-2021-31566"}],"ssvc":{"assessedAt":1793642516778,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2021-31566","updatedAt":1793642931273}