high8.8
CVE-2023-25307
mrpack-install vulnerable to path traversal with dependency
Impact
### Impact Importing a malicious `.mrpack` file can cause path traversal while downloading files. This can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing. ### Patches No patches yet. ### Workarounds Avoid importing `.mrpack` files from untrusted sources. ### References https://docs.modrinth.com/docs/modpacks/format_definition/#files
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/nothub/mrpack-install | <= 0.16.2 | 0.16.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mrpack-Install Project | Mrpack-Install | before 0.16.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr
- https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
- https://github.com/advisories/GHSA-r887-gfxh-m9rr
- https://github.com/nothub/mrpack-install/commit/a1f424b6a616d2de95228781eef3b92b9769f23c
- https://github.com/nothub/mrpack-install/releases/tag/v0.16.3
- https://nvd.nist.gov/vuln/detail/CVE-2023-25307