GHSA-f5c5-hmw9-v8hx

Suggest an improvement
Source
https://github.com/advisories/GHSA-f5c5-hmw9-v8hx
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-f5c5-hmw9-v8hx/GHSA-f5c5-hmw9-v8hx.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f5c5-hmw9-v8hx
Aliases
Published
2022-12-28T00:30:23Z
Modified
2023-11-08T04:03:47.481614Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
Summary
Unzip vulnerable to path traversal
Details

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

References

Affected packages

Go / github.com/yi-ge/unzip

Package

Name
github.com/yi-ge/unzip
View open source insights on deps.dev
Purl
pkg:golang/github.com/yi-ge/unzip

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.0.3-0.20200308084313-2adbaa4891b9