CVE-2020-36560 Path traversal in github.com/artdarek/go-unzip

2022-12-2721:13:20

www.cve.org

cve-2020-36560

path traversal

github

improper path sanitization

relative file paths

target directory

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

52.0%

JSON

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

CNA Affected

[
  {
    "vendor": "github.com/artdarek/go-unzip",
    "product": "github.com/artdarek/go-unzip",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "github.com/artdarek/go-unzip",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.0.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "Unzip.Extract"
      }
    ],
    "defaultStatus": "unaffected"
  }
]