by Kastro
Paper/Archive/CVE-2020-36561

CVE-2020-36561

github.com/yi-ge/unzip github.com/yi-ge/unzip — Path traversal in github.com/yi-ge/unzip

EPSS 1%public exploitCVSS 9.1
critical.is priorityof 100
52
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 72.7.727 × 2014.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

Affected

ProductAffectedFixed inSource
github.com/yi-ge/unzip< 1.0.3-0.20200308084313-2adbaa4891b91.0.3-0.20200308084313-2adbaa4891b9CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/yi-ge/unzip/pull/1refgithub.com/yi-ge/unzip/commit/2adbaa4891b9690853ef10216189189f5ad7dc73refsnyk.io/research/zip-slip-vulnerabilityrefpkg.go.dev/vuln/GO-2020-0035