GitHub Advisoryadvisory · PyPI

GHSA-8qch-vj6m-2694 luigi Arbitrary File Write via Archive Extraction (Zip Slip)

HIGH Published 2024-12-10 Modified 2025-02-11 Official page ↗
Aliases
CVE-2024-21542
Ecosystem
PyPI
Packages
luigi
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-22, CWE-29
Reviewed
2024-12-10

Affected packages

• PyPI luigi: < 3.6.0 → fixed in 3.6.0

Description

Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path validation in the _extract_packages_archive function.

Related

Alias · CVE (1)

  • CVE-2024-21542 Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper… vulnerability

Weakness · CWE (2)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-29 Path Traversal: '\..\filename' weakness

References