GHSA-9423-6c93-gpp8HighCVSS 7.5

github.com/sassoftware/go-rpmutils Arbitrary File Write via Archive Extraction (Zip Slip)

Published
June 23, 2021
Last Modified
August 29, 2023

🔗 CVE IDs covered (1)

CVE-2020-7667 →

📋 Description

The CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading .. which leads in file extraction outside of the current directory. Note, the fixing commit was applied to all affected versions which were re-released.

🎯 Affected products1

  • go/github.com/sassoftware/go-rpmutils:< 0.1.0

🔗 References (6)