GitHub Advisoryadvisory · Go

GHSA-5wmg-j84w-4jj4 Arbitrary File Write via Archive Extraction in mholt/archiver

MEDIUM Published 2022-02-15 Modified 2022-07-16 Official page ↗
Aliases
CVE-2018-1002207
Ecosystem
Go
Packages
github.com/mholt/archiver
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2021-05-20

Affected packages

• Go github.com/mholt/archiver: < 2.1.0 → fixed in 2.1.0

Description

mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Related

Alias · CVE (1)

  • CVE-2018-1002207 mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References