Medium severity5.5NVD Advisory· Published Mar 17, 2021· Updated Jun 17, 2026

CVE-2021-28650

Description

autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

GNOME/gnome-autoardescription
osv-coords57 versions
pkg:rpm/almalinux/gnome-shell-extension-systemMonitor pkg:rpm/almalinux/LibRaw pkg:rpm/almalinux/LibRaw-devel pkg:rpm/almalinux/accountsservice pkg:rpm/almalinux/accountsservice-devel pkg:rpm/almalinux/accountsservice-libs pkg:rpm/almalinux/gdm pkg:rpm/almalinux/gnome-autoar pkg:rpm/almalinux/gnome-calculator pkg:rpm/almalinux/gnome-classic-session pkg:rpm/almalinux/gnome-control-center pkg:rpm/almalinux/gnome-control-center-filesystem pkg:rpm/almalinux/gnome-online-accounts pkg:rpm/almalinux/gnome-online-accounts-devel pkg:rpm/almalinux/gnome-session pkg:rpm/almalinux/gnome-session-kiosk-session pkg:rpm/almalinux/gnome-session-wayland-session pkg:rpm/almalinux/gnome-session-xsession pkg:rpm/almalinux/gnome-settings-daemon pkg:rpm/almalinux/gnome-shell pkg:rpm/almalinux/gnome-shell-extension-apps-menu pkg:rpm/almalinux/gnome-shell-extension-auto-move-windows pkg:rpm/almalinux/gnome-shell-extension-common pkg:rpm/almalinux/gnome-shell-extension-dash-to-dock pkg:rpm/almalinux/gnome-shell-extension-desktop-icons pkg:rpm/almalinux/gnome-shell-extension-disable-screenshield pkg:rpm/almalinux/gnome-shell-extension-drive-menu pkg:rpm/almalinux/gnome-shell-extension-gesture-inhibitor pkg:rpm/almalinux/gnome-shell-extension-horizontal-workspaces pkg:rpm/almalinux/gnome-shell-extension-launch-new-instance pkg:rpm/almalinux/gnome-shell-extension-native-window-placement pkg:rpm/almalinux/gnome-shell-extension-no-hot-corner pkg:rpm/almalinux/gnome-shell-extension-panel-favorites pkg:rpm/almalinux/gnome-shell-extension-places-menu pkg:rpm/almalinux/gnome-shell-extension-screenshot-window-sizer pkg:rpm/almalinux/gnome-shell-extension-top-icons pkg:rpm/almalinux/gnome-shell-extension-updates-dialog pkg:rpm/almalinux/gnome-shell-extension-user-theme pkg:rpm/almalinux/gnome-shell-extension-window-grouper pkg:rpm/almalinux/gnome-shell-extension-window-list pkg:rpm/almalinux/gnome-shell-extension-windowsNavigator pkg:rpm/almalinux/gnome-shell-extension-workspace-indicator pkg:rpm/almalinux/gnome-software pkg:rpm/almalinux/gnome-software-devel pkg:rpm/almalinux/gsettings-desktop-schemas pkg:rpm/almalinux/gsettings-desktop-schemas-devel pkg:rpm/almalinux/gtk-update-icon-cache pkg:rpm/almalinux/gtk3 pkg:rpm/almalinux/gtk3-devel pkg:rpm/almalinux/gtk3-immodule-xim pkg:rpm/almalinux/mutter pkg:rpm/almalinux/mutter-devel pkg:rpm/almalinux/vino pkg:rpm/almalinux/webkit2gtk3 pkg:rpm/almalinux/webkit2gtk3-devel pkg:rpm/almalinux/webkit2gtk3-jsc pkg:rpm/almalinux/webkit2gtk3-jsc-devel
< 3.32.1-20.el8+ 56 more
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 0.19.5-3.el8
- (no CPE)range: < 0.19.5-3.el8
- (no CPE)range: < 0.6.55-2.el8
- (no CPE)range: < 0.6.55-2.el8
- (no CPE)range: < 0.6.55-2.el8
- (no CPE)range: < 1:40.0-15.el8
- (no CPE)range: < 0.2.3-2.el8
- (no CPE)range: < 3.28.2-2.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.28.2-28.el8
- (no CPE)range: < 3.28.2-28.el8
- (no CPE)range: < 3.28.2-3.el8
- (no CPE)range: < 3.28.2-3.el8
- (no CPE)range: < 3.28.1-13.el8
- (no CPE)range: < 3.28.1-13.el8
- (no CPE)range: < 3.28.1-13.el8
- (no CPE)range: < 3.28.1-13.el8
- (no CPE)range: < 3.32.0-16.el8.alma
- (no CPE)range: < 3.32.2-40.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.32.1-20.el8
- (no CPE)range: < 3.36.1-10.el8
- (no CPE)range: < 3.36.1-10.el8
- (no CPE)range: < 3.32.0-6.el8
- (no CPE)range: < 3.32.0-6.el8
- (no CPE)range: < 3.22.30-8.el8
- (no CPE)range: < 3.22.30-8.el8
- (no CPE)range: < 3.22.30-8.el8
- (no CPE)range: < 3.22.30-8.el8
- (no CPE)range: < 3.32.2-60.el8
- (no CPE)range: < 3.32.2-60.el8
- (no CPE)range: < 3.22.0-11.el8
- (no CPE)range: < 2.32.3-2.el8
- (no CPE)range: < 2.32.3-2.el8
- (no CPE)range: < 2.32.3-2.el8
- (no CPE)range: < 2.32.3-2.el8
GNOME Foundation/gnome-autoarllm-fuzzy2 versions
<0.3.1+ 1 more
- (no CPE)range: <0.3.1
- cpe:2.3:a:gnome:gnome-autoar:*:*:*:*:*:*:*:*range: <0.3.1
Fedoraproject/Fedora
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

gitlab.gnome.org/GNOME/gnome-autoar/-/commit/8109c368c6cfdb593faaf698c2bf5da32bb1ace4nvdPatchVendor Advisory
security.gentoo.org/glsa/202105-10nvdThird Party Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BN5TVQ7OHZEGY6AGFLAZWCVCI53RYNHQ/nvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000