Maniphest T7908

GnuPG Accepts Path Separators and Path Traversals in Literal Data "Filename" Field
Testing, LowPublic
Actions

Assigned To
None
Authored By
• gniibe
Nov 4 2025, 7:07 AM
Tags
Subscribers
• gniibe
thesamesam
• werner

Description

In GnuPG, the embedded filename (in Literal Data) handling is considered dangerous. It is used without enough sanitation or validation.

Related Objects
Search...

Event Timeline

• gniibe created this task.Nov 4 2025, 7:07 AM
• gniibe created this object in space Restricted Space.
• gniibe created this object with visibility "g10code (Project)".
• gniibe created this object with edit policy "g10code (Project)".

Added a compatibility flag in: rGad0c6c33c3d6: gpg: Do not use a default when asking for another output filename.

• gniibe mentioned this in Unknown Object (Maniphest Task).Nov 10 2025, 2:51 AM
• werner added a subscriber: • werner.Nov 19 2025, 4:08 PM

The problem is that a user may unintentionally use the suggested filename without checking that it does not harm to write to this file. It is better not to present a default name at all.

• werner mentioned this in T7940: Release GnuPG 2.5.15.Nov 19 2025, 5:37 PM
• werner mentioned this in T7869: Release GnuPG 2.5.14.Nov 19 2025, 5:40 PM
• werner changed the task status from Open to Testing.Nov 19 2025, 5:43 PM
• werner triaged this task as Low priority.
• werner shifted this object from the Restricted Space space to the S1 Public space.
• werner changed the visibility from "g10code (Project)" to "Public (No Login Required)".
• werner changed the edit policy from "g10code (Project)" to "Contributor (Project)".
• werner removed a project: g10code.
thesamesam added a subscriber: thesamesam.Dec 26 2025, 8:49 PM