{"id":21675272,"url":"https://github.com/jwilk/traversal-archives","last_synced_at":"2026-02-12T22:03:04.991Z","repository":{"id":41439759,"uuid":"69881003","full_name":"jwilk/traversal-archives","owner":"jwilk","description":"archive file samples for testing against directory traversal","archived":false,"fork":false,"pushed_at":"2025-03-29T17:56:43.000Z","size":61,"stargazers_count":158,"open_issues_count":0,"forks_count":16,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-09-11T22:48:43.855Z","etag":null,"topics":["security"],"latest_commit_sha":null,"homepage":null,"language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jwilk.png","metadata":{"files":{"readme":"README","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2016-10-03T14:52:29.000Z","updated_at":"2025-08-28T03:10:35.000Z","dependencies_parsed_at":"2025-09-11T21:47:52.865Z","dependency_job_id":"7a05172d-d15c-4399-81d9-9b34ffb2fc12","html_url":"https://github.com/jwilk/traversal-archives","commit_stats":{"total_commits":104,"total_committers":1,"mean_commits":104.0,"dds":0.0,"last_synced_commit":"0f1d7bb8aa546aa9259c23c727048ea0f86eff77"},"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/jwilk/traversal-archives","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwilk%2Ftraversal-archives","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwilk%2Ftraversal-archives/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwilk%2Ftraversal-archives/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwilk%2Ftraversal-archives/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jwilk","download_url":"https://codeload.github.com/jwilk/traversal-archives/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jwilk%2Ftraversal-archives/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29382878,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-12T20:34:40.886Z","status":"ssl_error","status_checked_at":"2026-02-12T20:23:00.490Z","response_time":55,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["security"],"created_at":"2024-11-25T13:51:47.658Z","updated_at":"2026-02-12T22:03:04.962Z","avatar_url":"https://github.com/jwilk.png","language":"Makefile","funding_links":[],"categories":[],"sub_categories":[],"readme":"Overview\n--------\n\nThis repository provides samples of archive files in various formats\nthat attempt to exploit (hypothetical) directory traversal bugs:\n\n.. automatically generated by .private/update-readme\n\n* Leading slash::\n\n     -rw-r--r--  /tmp/moo\n\n  `7zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.7z\u003e`__\n  `ar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.a\u003e`__\n  `arc \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.arc\u003e`__\n  `arj \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.arj\u003e`__\n  `cab \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.cab\u003e`__\n  `cpio \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.cpio\u003e`__\n  `rar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.rar\u003e`__\n  `tar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.tar\u003e`__\n  `zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.zip\u003e`__\n  `zoo \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute1.zoo\u003e`__\n\n* Multiple leading slashes::\n\n     -rw-r--r--  //tmp/moo\n\n  `ar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute2.a\u003e`__\n  `arc \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute2.arc\u003e`__\n  `arj \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute2.arj\u003e`__\n  `cab \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute2.cab\u003e`__\n  `cpio \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute2.cpio\u003e`__\n  `rar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute2.rar\u003e`__\n  `tar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute2.tar\u003e`__\n  `zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute2.zip\u003e`__\n  `zoo \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/absolute2.zoo\u003e`__\n\n* Leading dot-dot::\n\n     -rw-r--r--  ../moo\n\n  `7zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.7z\u003e`__\n  `ar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.a\u003e`__\n  `arc \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.arc\u003e`__\n  `arj \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.arj\u003e`__\n  `cab \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.cab\u003e`__\n  `cpio \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.cpio\u003e`__\n  `rar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.rar\u003e`__\n  `tar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.tar\u003e`__\n  `zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.zip\u003e`__\n  `zoo \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative0.zoo\u003e`__\n\n* Non-leading dot-dot::\n\n     -rw-r--r--  tmp/../../moo\n\n  `7zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative2.7z\u003e`__\n  `ar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative2.a\u003e`__\n  `arj \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative2.arj\u003e`__\n  `cab \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative2.cab\u003e`__\n  `cpio \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative2.cpio\u003e`__\n  `rar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative2.rar\u003e`__\n  `tar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative2.tar\u003e`__\n  `zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative2.zip\u003e`__\n  `zoo \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/relative2.zoo\u003e`__\n\n* File symlink::\n\n     lrwxrwxrwx  moo -\u003e /tmp/moo\n     -rw-r--r--  moo\n\n  `7zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/symlink.7z\u003e`__\n  `arj \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/symlink.arj\u003e`__\n  `cpio \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/symlink.cpio\u003e`__\n  `rar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/symlink.rar\u003e`__\n  `tar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/symlink.tar\u003e`__\n  `zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/symlink.zip\u003e`__\n\n* Directory symlink::\n\n     lrwxrwxrwx  tmp -\u003e /tmp\n     -rw-r--r--  tmp/moo\n\n  `7zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.7z\u003e`__\n  `arj \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.arj\u003e`__\n  `cpio \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.cpio\u003e`__\n  `rar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.rar\u003e`__\n  `tar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.tar\u003e`__\n  `zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink.zip\u003e`__\n\n* Two directory symlinks (variant A)::\n\n     lrwxrwxrwx  cur -\u003e .\n     lrwxrwxrwx  par -\u003e cur/..\n     -rw-r--r--  par/moo\n\n  `7zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.7z\u003e`__\n  `arj \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.arj\u003e`__\n  `cpio \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.cpio\u003e`__\n  `rar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.rar\u003e`__\n  `tar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.tar\u003e`__\n  `zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2a.zip\u003e`__\n\n* Two directory symlinks (variant B)::\n\n     lrwxrwxrwx  cur -\u003e .\n     lrwxrwxrwx  cur/par -\u003e ..\n     -rw-r--r--  par/moo\n\n  `7zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.7z\u003e`__\n  `arj \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.arj\u003e`__\n  `cpio \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.cpio\u003e`__\n  `rar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.rar\u003e`__\n  `tar \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.tar\u003e`__\n  `zip \u003chttps://github.com/jwilk/traversal-archives/releases/download/0/dirsymlink2b.zip\u003e`__\n\n.. end of generated stuff\n\nFound bugs\n----------\n\nThe samples helped find the following bugs:\n\n* ARJ:\n\n  - https://bugs.debian.org/774434 [CVE-2015-0556]\n  - https://bugs.debian.org/774435 [CVE-2015-0557]\n  - https://bugs.debian.org/867520\n\n* Zoo:\n\n  - https://bugs.debian.org/774453\n\n* ARC:\n\n  - https://bugs.debian.org/774527 [CVE-2015-9275]\n\n* gcab:\n\n  - https://bugs.debian.org/774580 [CVE-2015-0552]\n\n* UnRAR:\n\n  - https://www.openwall.com/lists/oss-security/2017/08/14/3 [CVE-2017-12938]\n\n* Perl (Archive::Tar):\n\n  - https://bugs.debian.org/900834 [CVE-2018-12015]\n\n* GNOME Nautilus:\n\n  - https://bugs.debian.org/878012\n\n* Ark:\n\n  - https://bugs.debian.org/878269\n\n* archiver:\n\n  - https://github.com/mholt/archiver/issues/69\n\n.. vim:ts=3 sts=3 sw=3 et ft=rst\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjwilk%2Ftraversal-archives","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjwilk%2Ftraversal-archives","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjwilk%2Ftraversal-archives/lists"}