GitHub Advisoryadvisory · Go
GHSA-r887-gfxh-m9rr mrpack-install vulnerable to path traversal with dependency
HIGH
Official page ↗
- Aliases
- CVE-2023-25307
- Ecosystem
- Go
- Packages
- github.com/nothub/mrpack-install
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-22
- Reviewed
- 2023-02-08
Affected packages
• Go github.com/nothub/mrpack-install: < 0.16.3 → fixed in 0.16.3
Description
Impact
Importing a malicious `.mrpack` file can cause path traversal while downloading files.
This can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing.
Patches
No patches yet.
Workarounds
Avoid importing `.mrpack` files from untrusted sources.
References
https://docs.modrinth.com/docs/modpacks/format_definition/#files
Related
Alias · CVE (1)
- CVE-2023-25307 nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal. vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr web
- https://nvd.nist.gov/vuln/detail/CVE-2023-25307 advisory
- https://github.com/nothub/mrpack-install/commit/a1f424b6a616d2de95228781eef3b92b9769f23c web
- https://github.com/nothub/mrpack-install package
- https://github.com/nothub/mrpack-install/releases/tag/v0.16.3 web
- https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities web