critical9.1
CVE-2020-36561
Unzip vulnerable to path traversal
Impact
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/yi-ge/unzip | < 1.0.3-0.20200308084313-2adbaa4891b9 | 1.0.3-0.20200308084313-2adbaa4891b9 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Unzip Project | Unzip | before 1.0.3-0.20200308084313-2adbaa4891b9 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/yi-ge/unzip/commit/2adbaa4891b9690853ef10216189189f5ad7dc73
- https://github.com/yi-ge/unzip/pull/1
- https://pkg.go.dev/vuln/GO-2020-0035
- https://snyk.io/research/zip-slip-vulnerability
- https://github.com/advisories/GHSA-f5c5-hmw9-v8hx
- https://nvd.nist.gov/vuln/detail/CVE-2020-36561