Path Traversal

2022-11-1802:10:29

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

fileutil subpackage

path traversal

zipslip

unzip function

malicious zip file

software

EPSS

0.002

Percentile

59.0%

JSON

The fileutil subpackage in github.com/duke-git/lancet is vulnerable to path traversal. The vulnerability exists in the UnZip function in file.go due to a ZipSlip vulnerability which allows an attacker to create files outside the designated target directory using malicious zip file names.