42 matches found
Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory
Summary aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlinkf.LinkTarget, dstPath without validating that the symlink target resolves inside the extraction destination. A...
GHSA-MF5C-HW34-4HPP Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory
Summary aquaproj/aqua extracts downloaded tool archives through pkg/unarchive/archives.go using github.com/mholt/archives. The archive handler creates symlink entries with os.Symlinkf.LinkTarget, dstPath without validating that the symlink target resolves inside the extraction destination. A...
CVE-2024-0406-POC
CVE-2024-0406 Proof of Concept PoC Dieses Repository enthält einen Proof of Concept PoC-Exploit für CVE-2024-0406 , eine Schwachstelle, die auf symlink-basierter Tar-Archivextraktion beruht und Path Traversal oder das Überschreiben von Dateien in betroffenen Systemen ermöglicht. Weitere Details...
PoC-CVE-2019-10743
Zip Slip डेमो यह प्रोजेक्ट mholt/archiver पैकेज के असुरक्षित संस्करण का उपयोग करके Zip Slip भेद्यता CVE-2019-10743 को प्रदर्शित करता है। Zip Slip क्या है? Zip Slip एक भेद्यता है जिसे Snyk के सुरक्षा शोधकर्ताओं ने खोजा था। यह पाया गया कि यह भेद्यता कई पैकेजों को प्रभावित कर रही है जिनका उपयोग...
EUVD-2023-0378
Malicious code in bioql PyPI...
EUVD-2025-10908
Malicious code in bioql PyPI...
SUSE CVE-2025-3445
A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...
mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File
A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...
GHSA-7VPP-9CXJ-Q8GV mholt/archiver Vulnerable to Path Traversal via Crafted ZIP File
A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...
CVE-2025-3445
A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...
CVE-2025-3445
A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...
CVE-2025-3445
A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...
CVE-2025-3445
A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...
CVE-2025-3445
CVE-2025-3445 (Zip Slip in mholt/archiver, Go) : A crafted ZIP can cause path traversal during archiver.Unarchive(zipFile, outputDir), permitting write/overwrite of files with the app’s privileges. This can lead to privilege escalation or code execution in affected setups. The advisory notes a TA...
PT-2025-16188 · Unknown · Mholt/Archiver
Name of the Vulnerable Software and Affected Versions: mholt/archiver versions affected versions not specified Description: A Path Traversal "Zip Slip" vulnerability has been identified in the mholt/archiver library in Go. This issue allows an attacker to use a crafted ZIP file containing path...
GO-2022-0799 Arbitrary File Write via Archive Extraction in mholt/archiver in github.com/mholt/archiver
Arbitrary File Write via Archive Extraction in mholt/archiver in github.com/mholt/archiver...
GHSA-RHH4-RH7C-7R5V Archiver Path Traversal vulnerability
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privilege...
CVE-2024-0406
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privilege...
CVE-2024-0406
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privilege...
CVE-2024-0406
CVE-2024-0406 concerns the mholt/archiver package. The connected Nessus/SUSE entries confirm a path-traversal flaw in tar unpacking that can cause writing to restricted files or directories when extracting archives. The remediation path shown in the connected docs includes upgrading the affected ...