GHSA-vpx7-vm66-qx8rHighCVSS 7.5

Path Traversal in github.com/unknwon/cae/zip

Published
May 18, 2021
Last Modified
October 2, 2023

🔗 CVE IDs covered (1)

CVE-2020-7664 →

📋 Description

The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

Specific Go Packages Affected

github.com/unknwon/cae/zip

🎯 Affected products1

  • go/github.com/unknwon/cae:< 1.0.1

🔗 References (5)