GitHub Advisoryadvisory · Go

GHSA-fx2v-qfhr-4chv Goutil vulnerable to path traversal when unzipping files

HIGH Published 2023-03-07 Modified 2023-03-07 Official page ↗
Aliases
CVE-2023-27475
Ecosystem
Go
Packages
github.com/gookit/goutil
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2023-03-07

Affected packages

• Go github.com/gookit/goutil: < 0.6.0 → fixed in 0.6.0

Description

Impact ZipSlip issue when use fsutil package to unzip files. When users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. Patches It has been fixed in v0.6.0, Please upgrade version to v0.6.0 or above. Workarounds No, users have to upgrade version.

Related

Alias · CVE (1)

  • CVE-2023-27475 Goutil is a collection of miscellaneous functionality for the go language. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References