GHSA-88jf-7rch-32qcHighCVSS 7.5

github.com/unknwon/cae Path Traversal vulnerability

Published
May 18, 2021
Last Modified
August 30, 2023

🔗 CVE IDs covered (1)

CVE-2020-7668 →

📋 Description

The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

🎯 Affected products1

  • go/github.com/unknwon/cae:< 1.0.1

🔗 References (6)