CVE-2020-26277: Symbolic links in dbdeployer unpacking routine enable arbitrary file read and write
Summary
CVE-2020-26277: Impact _Users unpacking a tarball through dbdeployer may use a maliciously packaged tarball that contains symlinks to files external to the target. Affects github.com/datacharmer/dbdeployer versions < 1.58.2. Fixed in 1.58.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dbdeployer is an open-source tool written in Go that allows users to easily deploy and manage MySQL database instances. It is designed to be used as an unprivileged user, but can also be used as root. The tool includes an unpacking routine for tarballs, which is vulnerable to symbolic link attacks.
Vulnerability Detail
The vulnerability in dbdeployer's unpacking routine allows an attacker to create a malicious tarball that contains symbolic links to files outside of the target directory. When the tarball is unpacked, dbdeployer will create the symbolic links as defined, potentially allowing an attacker to read and write to arbitrary locations on the system. This could lead to the alteration of system files and compromise the security of the computer. However, several mitigating factors need to be present for the attack to succeed, such as the user being logged in as root and using a tarball from a non-secure source without verifying the checksum.
How To Fix
Latest published version: v1.73.0 as of 22 Oct 2026
go get github.com/datacharmer/dbdeployer@v1.73.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.58.2
This is the first release that contains the fix.
go get github.com/datacharmer/dbdeployer@v1.58.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in dbdeployer's unpacking routine allows attackers to read and write to arbitrary locations on the system. It has been patched in release 1.58.2, and users are advised to update to the latest version. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/datacharmer/dbdeployer →
FAQ
dbdeployer is an open-source tool written in Go that allows users to easily deploy and manage MySQL database instances.
The vulnerability allows an attacker to read and write to arbitrary locations on the system, potentially compromising system files and defenses.
The user must be logged in as root and use a tarball from a non-secure source without verifying the checksum for the attack to succeed.
Update dbdeployer to version 1.58.2 or later to fix the vulnerability.
No specific workaround is mentioned for this vulnerability.
