Impact

A Tar slip vulnerability was found in Autolab's install assessment functionality, whereby an instructor with access to the feature can perform an arbitrary file write.

Patches

The vulnerability has been patched in v2.11.0.

Workarounds

There are no feasible workarounds for this issue.

References

• Zip Slip Vulnerability

For more information

If you have any questions or comments about this advisory:

• Open an issue in https://github.com/autolab/Autolab/
• Email us at autolab-dev@andrew.cmu.edu