GO-2020-0035

vendorUSosv

Path traversal in github.com/yi-ge/unzip

view advisory published 2021-04-14Licence: per source

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-36561US	critical9.1	1.41% (73rd)	—	2022-12-27
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

references

External citations — patches, advisories, analysis.

https://github.com/yi-ge/unzip/commit/2adbaa4891b9690853ef10216189189f5ad7dc73FIX
https://github.com/yi-ge/unzip/pull/1FIX
https://snyk.io/research/zip-slip-vulnerabilityWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan