GHSA-5wmg-j84w-4jj4MediumCVSS 5.5

Arbitrary File Write via Archive Extraction in mholt/archiver

Published
February 15, 2022
Last Modified
January 11, 2023

🔗 CVE IDs covered (1)

CVE-2018-1002207 →

📋 Description

mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

🎯 Affected products1

  • go/github.com/mholt/archiver:< 2.1.0

🔗 References (7)