Medium
Security advisory
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-16680
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:25 UTC · Revision 1
Source evidence
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
osv:CVE-2019-16680
Complete source record
{
"id": "a263e150e357fdd6bc82f1f32f77fb8d10712e97e61a225a9804f5ba6b275b9e",
"url": "https://osv.dev/vulnerability/CVE-2019-16680",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-16680",
"summary": "An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.",
"evidence": "osv:CVE-2019-16680",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-16680",
"aliases": [
"CVE-2019-16680"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gnome/file-roller",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "e8fb3e24dae711e4fb0d6777e0016cdda8787bc1"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gnome:file-roller:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.29.91"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"3.29.90",
"3.29.1",
"3.28.0",
"3.27.91",
"3.27.90",
"3.27.1",
"3.26.1",
"3.26.0",
"3.25.91",
"3.25.1",
"3.24.1",
"3.24.0",
"3.23.92",
"3.23.91",
"3.22.3",
"3.22.2",
"3.22.1",
"3.22.0",
"3.21.91",
"3.21.90",
"3.20.2",
"3.20.1",
"3.20.0",
"3.19.91",
"3.19.90",
"3.19.1",
"3.16.4",
"3.16.3",
"3.16.2",
"3.16.1",
"3.16.0",
"3.15.92",
"3.15.91",
"3.15.90",
"3.15.2",
"3.14.1",
"3.15.1",
"3.14.0",
"3.13.92",
"3.13.91",
"3.13.2",
"3.13.1",
"3.12.1",
"3.12.0",
"3.11.92",
"3.11.91",
"3.11.90",
"3.11.5",
"3.11.4",
"3.11.3",
"3.11.2",
"3.11.1",
"3.10.1",
"3.10.0",
"3.9.92",
"3.9.91",
"3.9.90",
"3.9.4",
"3.9.3",
"3.9.2",
"3.9.1",
"3.8.1",
"3.8.0",
"3.7.92",
"3.7.91",
"3.7.90",
"3.7.3",
"3.7.2",
"3.7.1",
"3.6.2",
"3.6.1.1",
"3.6.1",
"3.6.0",
"3.5.92",
"3.5.91",
"3.5.90",
"3.5.4",
"3.5.3",
"3.5.2",
"3.5.1",
"3.4.2",
"3.4.1",
"3.4.0",
"3.3.92",
"3.3.91",
"3.3.90",
"3.3.3",
"3.3.2",
"3.3.1",
"3.2.1",
"3.2.0",
"3.1.92",
"3.1.91",
"3.1.90",
"3.1.2",
"3.1.1",
"3.0.2",
"3.0.1",
"FILE_ROLLER_3_0_0",
"FILE_ROLLER_2_91_93",
"FILE_ROLLER_2_91_92",
"FILE_ROLLER_2_91_91",
"FILE_ROLLER_2_91_90",
"FILE_ROLLER_2_91_6",
"FILE_ROLLER_2_91_5",
"FILE_ROLLER_2_91_4",
"FILE_ROLLER_2_91_3",
"FILE_ROLLER_2_91_2",
"FILE_ROLLER_2_91_1",
"FILE_ROLLER_2_91_0",
"FILE_ROLLER_2_32_0",
"FILE_ROLLER_2_31_92",
"FILE_ROLLER_2_31_91",
"FILE_ROLLER_2_31_90",
"FILE_ROLLER_2_31_5",
"FILE_ROLLER_2_31_4",
"FILE_ROLLER_2_31_3",
"FILE_ROLLER_2_31_2",
"FILE_ROLLER_2_31_1",
"FILE_ROLLER_2_30_1_1",
"FILE_ROLLER_2_30_1",
"FILE_ROLLER_2_30_0",
"FILE_ROLLER_2_29_92",
"FILE_ROLLER_2_29_91",
"FILE_ROLLER_2_29_90",
"FILE_ROLLER_2_29_5",
"FILE_ROLLER_2_29_4",
"FILE_ROLLER_2_29_3",
"FILE_ROLLER_2_29_2",
"FILE_ROLLER_2_29_1",
"FILE_ROLLER_2_28_1",
"FILE_ROLLER_2_28_0",
"FILE_ROLLER_2_27_92",
"FILE_ROLLER_2_27_91",
"FILE_ROLLER_2_27_90",
"FILE_ROLLER_2_27_3",
"FILE_ROLLER_2_27_2",
"FILE_ROLLER_2_27_1",
"FILE_ROLLER_2_26_1",
"FILE_ROLLER_2_26_0",
"FILE_ROLLER_2_25_92",
"FILE_ROLLER_2_25_91",
"FILE_ROLLER_2_25_90",
"FILE_ROLLER_2_25_2",
"FILE_ROLLER_2_25_1",
"FILE_ROLLER_2_24_2",
"FILE_ROLLER_2_24_1",
"FILE_ROLLER_2_24_0",
"FILE_ROLLER_2_23_92",
"FILE_ROLLER_2_23_91",
"FILE_ROLLER_2_23_6",
"FILE_ROLLER_2_23_5",
"FILE_ROLLER_2_23_4",
"FILE_ROLLER_2_23_3",
"FILE_ROLLER_2_23_2",
"FILE_ROLLER_2_23_1",
"FILE_ROLLER_2_22_0",
"FILE_ROLLER_2_21_92",
"FILE_ROLLER_2_21_91",
"FILE_ROLLER_2_21_2",
"FILE_ROLLER_2_21_1",
"FILE_ROLLER_2_20_2",
"FILE_ROLLER_2_20_1",
"FILE_ROLLER_2_20_0",
"FILE_ROLLER_2_19_92",
"FILE_ROLLER_2_19_91",
"FILE_ROLLER_2_19_90",
"FILE_ROLLER_2_19_4",
"FILE_ROLLER_2_19_3",
"FILE_ROLLER_2_19_2",
"FILE_ROLLER_2_19_1",
"FILE_ROLLER_2_18_0",
"FILE_ROLLER_2_17_92",
"FILE_ROLLER_2_17_91",
"FILE_ROLLER_2_17_90",
"FILE_ROLLER_2_17_5",
"FILE_ROLLER_2_17_4",
"FILE_ROLLER_2_17_3",
"FILE_ROLLER_2_17_2",
"FILE_ROLLER_2_17_1",
"FILE_ROLLER_2_16_1",
"FILE_ROLLER_2_16_0",
"FILE_ROLLER_2_15_93",
"FILE_ROLLER_2_15_92",
"FILE_ROLLER_2_15_91",
"FILE_ROLLER_2_15_90",
"FILE_ROLLER_2_15_1",
"FILE_ROLLER_2_14_3",
"FILE_ROLLER_2_14_2",
"FILE_ROLLER_2_14_1",
"FILE_ROLLER_2_14_0",
"FILE_ROLLER_2_13_92",
"FILE_ROLLER_2_13_91",
"FILE_ROLLER_2_13_90",
"FILE_ROLLER_2_13_4",
"FILE_ROLLER_2_13_2",
"FILE_ROLLER_2_4_0_1",
"start"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16680.json"
}
},
{
"ranges": [
{
"repo": "https://gitlab.gnome.org/gnome/file-roller",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "e8fb3e24dae711e4fb0d6777e0016cdda8787bc1"
},
{
"fixed": "57268e51e59b61c9e3125eb0f65551c7084297e2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gnome:file-roller:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.29.91"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "57268e51e59b61c9e3125eb0f65551c7084297e2"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "e8fb3e24dae711e4fb0d6777e0016cdda8787bc1"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.29.90",
"3.29.1",
"3.28.0",
"3.27.91",
"3.27.90",
"3.27.1",
"3.26.1",
"3.26.0",
"3.25.91",
"3.25.1",
"3.24.1",
"3.24.0",
"3.23.92",
"3.23.91",
"3.22.3",
"3.22.2",
"3.22.1",
"3.22.0",
"3.21.91",
"3.21.90",
"3.20.2",
"3.20.1",
"3.20.0",
"3.19.91",
"3.19.90",
"3.19.1",
"3.16.4",
"3.16.3",
"3.16.2",
"3.16.1",
"3.16.0",
"3.15.92",
"3.15.91",
"3.15.90",
"3.15.2",
"3.14.1",
"3.15.1",
"3.14.0",
"3.13.92",
"3.13.91",
"3.13.2",
"3.13.1",
"3.12.1",
"3.12.0",
"3.11.92",
"3.11.91",
"3.11.90",
"3.11.5",
"3.11.4",
"3.11.3",
"3.11.2",
"3.11.1",
"3.10.1",
"3.10.0",
"3.9.92",
"3.9.91",
"3.9.90",
"3.9.4",
"3.9.3",
"3.9.2",
"3.9.1",
"3.8.1",
"3.8.0",
"3.7.92",
"3.7.91",
"3.7.90",
"3.7.3",
"3.7.2",
"3.7.1",
"3.6.2",
"3.6.1.1",
"3.6.1",
"3.6.0",
"3.5.92",
"3.5.91",
"3.5.90",
"3.5.4",
"3.5.3",
"3.5.2",
"3.5.1",
"3.4.2",
"3.4.1",
"3.4.0",
"3.3.92",
"3.3.91",
"3.3.90",
"3.3.3",
"3.3.2",
"3.3.1",
"3.2.1",
"3.2.0",
"3.1.92",
"3.1.91",
"3.1.90",
"3.1.2",
"3.1.1",
"3.0.2",
"3.0.1",
"FILE_ROLLER_3_0_0",
"FILE_ROLLER_2_91_93",
"FILE_ROLLER_2_91_92",
"FILE_ROLLER_2_91_91",
"FILE_ROLLER_2_91_90",
"FILE_ROLLER_2_91_6",
"FILE_ROLLER_2_91_5",
"FILE_ROLLER_2_91_4",
"FILE_ROLLER_2_91_3",
"FILE_ROLLER_2_91_2",
"FILE_ROLLER_2_91_1",
"FILE_ROLLER_2_91_0",
"FILE_ROLLER_2_32_0",
"FILE_ROLLER_2_31_92",
"FILE_ROLLER_2_31_91",
"FILE_ROLLER_2_31_90",
"FILE_ROLLER_2_31_5",
"FILE_ROLLER_2_31_4",
"FILE_ROLLER_2_31_3",
"FILE_ROLLER_2_31_2",
"FILE_ROLLER_2_31_1",
"FILE_ROLLER_2_30_1_1",
"FILE_ROLLER_2_30_1",
"FILE_ROLLER_2_30_0",
"FILE_ROLLER_2_29_92",
"FILE_ROLLER_2_29_91",
"FILE_ROLLER_2_29_90",
"FILE_ROLLER_2_29_5",
"FILE_ROLLER_2_29_4",
"FILE_ROLLER_2_29_3",
"FILE_ROLLER_2_29_2",
"FILE_ROLLER_2_29_1",
"FILE_ROLLER_2_28_1",
"FILE_ROLLER_2_28_0",
"FILE_ROLLER_2_27_92",
"FILE_ROLLER_2_27_91",
"FILE_ROLLER_2_27_90",
"FILE_ROLLER_2_27_3",
"FILE_ROLLER_2_27_2",
"FILE_ROLLER_2_27_1",
"FILE_ROLLER_2_26_1",
"FILE_ROLLER_2_26_0",
"FILE_ROLLER_2_25_92",
"FILE_ROLLER_2_25_91",
"FILE_ROLLER_2_25_90",
"FILE_ROLLER_2_25_2",
"FILE_ROLLER_2_25_1",
"FILE_ROLLER_2_24_2",
"FILE_ROLLER_2_24_1",
"FILE_ROLLER_2_24_0",
"FILE_ROLLER_2_23_92",
"FILE_ROLLER_2_23_91",
"FILE_ROLLER_2_23_6",
"FILE_ROLLER_2_23_5",
"FILE_ROLLER_2_23_4",
"FILE_ROLLER_2_23_3",
"FILE_ROLLER_2_23_2",
"FILE_ROLLER_2_23_1",
"FILE_ROLLER_2_22_0",
"FILE_ROLLER_2_21_92",
"FILE_ROLLER_2_21_91",
"FILE_ROLLER_2_21_2",
"FILE_ROLLER_2_21_1",
"FILE_ROLLER_2_20_2",
"FILE_ROLLER_2_20_1",
"FILE_ROLLER_2_20_0",
"FILE_ROLLER_2_19_92",
"FILE_ROLLER_2_19_91",
"FILE_ROLLER_2_19_90",
"FILE_ROLLER_2_19_4",
"FILE_ROLLER_2_19_3",
"FILE_ROLLER_2_19_2",
"FILE_ROLLER_2_19_1",
"FILE_ROLLER_2_18_0",
"FILE_ROLLER_2_17_92",
"FILE_ROLLER_2_17_91",
"FILE_ROLLER_2_17_90",
"FILE_ROLLER_2_17_5",
"FILE_ROLLER_2_17_4",
"FILE_ROLLER_2_17_3",
"FILE_ROLLER_2_17_2",
"FILE_ROLLER_2_17_1",
"FILE_ROLLER_2_16_1",
"FILE_ROLLER_2_16_0",
"FILE_ROLLER_2_15_93",
"FILE_ROLLER_2_15_92",
"FILE_ROLLER_2_15_91",
"FILE_ROLLER_2_15_90",
"FILE_ROLLER_2_15_1",
"FILE_ROLLER_2_14_3",
"FILE_ROLLER_2_14_2",
"FILE_ROLLER_2_14_1",
"FILE_ROLLER_2_14_0",
"FILE_ROLLER_2_13_92",
"FILE_ROLLER_2_13_91",
"FILE_ROLLER_2_13_90",
"FILE_ROLLER_2_13_4",
"FILE_ROLLER_2_13_2",
"FILE_ROLLER_2_4_0_1",
"start"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16680.json",
"vanir_signatures": [
{
"id": "CVE-2019-16680-0aa778df",
"digest": {
"length": 444,
"function_hash": "27155979717750704031034549997628743833"
},
"source": "https://gitlab.gnome.org/gnome/file-roller@57268e51e59b61c9e3125eb0f65551c7084297e2",
"target": {
"file": "src/glib-utils.c",
"function": "sanitize_filename"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-16680-a60e9b0a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"138656517418615610897130002064559785166",
"247896318390256146051722219473642331694",
"198896843324868053886547451836575139848",
"113159501639207269924903206868110738369"
]
},
"source": "https://gitlab.gnome.org/gnome/file-roller@57268e51e59b61c9e3125eb0f65551c7084297e2",
"target": {
"file": "src/glib-utils.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:22:33Z"
}
}
],
"modified": "2026-10-24T14:22:33.527222049Z",
"provider": "osv",
"references": [
"https://bugzilla.redhat.com/show_bug.cgi?id=1767594",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00032.html",
"https://seclists.org/bugtraq/2019/Sep/57",
"https://usn.ubuntu.com/4139-1/",
"https://www.debian.org/security/2019/dsa-4537",
"https://bugzilla.gnome.org/show_bug.cgi?id=794337",
"https://gitlab.gnome.org/GNOME/file-roller/commit/57268e51e59b61c9e3125eb0f65551c7084297e2",
"https://gitlab.gnome.org/GNOME/file-roller/commit/e8fb3e24dae711e4fb0d6777e0016cdda8787bc1"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux",
"extracted_events": [
{
"range": [
{
"introduced": "7.0"
},
{
"last_affected": "7.0"
},
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-16680",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443662,
"published_at": "2019-09-21T21:15:10.657+00:00"
}