# Directory traversal vulnerability in Shapefile parser[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-9378.html#directory-traversal-vulnerability-in-shapefile-parser "Permalink to this headline")

## Information[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-9378.html#information "Permalink to this headline")

* CVE Id: CVE-2020-9378

* CVSS Base Score: 7.5

* Severity: High

* CWE classification: CWE-23

## Summary[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-9378.html#summary "Permalink to this headline")

The Shapefile parser in Dataiku DSS before 6.0.5 insufficiently sanitizes zipped Shapefiles, which allows an attacker to overwrite configuration files through crafted zipped Shapefiles.

## Affected Products[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-9378.html#affected-products "Permalink to this headline")

Dataiku DSS in versions before 6.0.5

## Mitigation[¶](https://doc.dataiku.com/dss/latest/security/advisories/cve-2020-9378.html#mitigation "Permalink to this headline")

Dataiku DSS 6.0.5 has been made available to customers to remediate this issue
