by Kastro
Paper/Archive/CVE-2020-36560

CVE-2020-36560

github.com/artdarek/go-unzip github.com/artdarek/go-unzip — Path traversal in github.com/artdarek/go-unzip

EPSS 1%public exploitCVSS 9.1
critical.is priorityof 100
52
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 71.1.711 × 2014.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

Affected

ProductAffectedFixed inSource
github.com/artdarek/go-unzip< 1.0.01.0.0CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/artdarek/go-unzip/pull/2refgithub.com/artdarek/go-unzip/commit/4975cbe0a719dc50b12da8585f1f207c82f7dfe0refsnyk.io/research/zip-slip-vulnerabilityrefpkg.go.dev/vuln/GO-2020-0034