GitHub Advisoryadvisory · Pub

GHSA-9v85-q87q-g4vg Path traversal in Archive

HIGH Published 2023-08-31 Modified 2023-09-07 Official page ↗
Aliases
CVE-2023-39139
Ecosystem
Pub
Packages
archive
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2023-08-31

Affected packages

• Pub archive: < 3.3.8 → fixed in 3.3.8

Description

An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.

Related

Alias · CVE (1)

  • CVE-2023-39139 An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References