Lucene search

K
cvelistGoCVELIST:CVE-2020-36561
HistoryDec 27, 2022 - 9:13 p.m.

CVE-2020-36561 Path traversal in github.com/yi-ge/unzip

2022-12-2721:13:22
Go
www.cve.org
1
path traversal
github
archives
relative file paths
target directory

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

CNA Affected

[
  {
    "vendor": "github.com/yi-ge/unzip",
    "product": "github.com/yi-ge/unzip",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "github.com/yi-ge/unzip",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.0.3-0.20200308084313-2adbaa4891b9",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "programRoutines": [
      {
        "name": "Unzip.Extract"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

Related for CVELIST:CVE-2020-36561