Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/07/20 10:16 p.m.11 views

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

Summary The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 shipped in v2.63.6 added a strings.ReplaceAllnameInArchive, "\", "/" step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it...

6.8CVSS6AI score0.00259EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder