high7.5
CVE-2020-7668
github.com/unknwon/cae Path Traversal vulnerability
Impact
The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/unknwon/cae | < 1.0.1 | 1.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Compression And Archive Extensions Tz Project | Compression And Archive Extensions Tz Project | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAETZ-570384
- https://github.com/advisories/GHSA-88jf-7rch-32qc
- https://nvd.nist.gov/vuln/detail/CVE-2020-7668
- https://github.com/unknwon/cae/commit/07971c00a1bfd9dc171c3ad0bfab5b67c2287e11
- https://pkg.go.dev/vuln/GO-2020-0041
- https://snyk.io/research/zip-slip-vulnerability