CVE-2024-47877
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-47877
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47877.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-47877
- Aliases
- Downstream
- Related
- Published
- 2024-10-11T16:36:29Z
- Modified
- 2025-10-15T14:55:20.762738Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
- Details
-
Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.
- References