CVE-2020-7669: U-Root

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.

Affected products

• U-Root U-Root: any version

Published 2020-09-01. Last modified 2026-06-17.