gookit/goutil · Security
Goutil vulnerable to path traversal when unzipping files
- GHSA ID
- GHSA-fx2v-qfhr-4chv
- CVE ID
- CVE-2023-27475
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Impact
ZipSlip issue when use fsutil package to unzip files. When users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal.
Patches
It has been fixed in v0.6.0, Please upgrade version to v0.6.0 or above.
Workarounds
No, users have to upgrade version.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- https://github.com/gookit/goutil/security/advisories/GHSA-fx2v-qfhr-4chv ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-27475 ↗
- https://github.com/gookit/goutil/commit/d7b94fede71f018f129f7d21feb58c895d28dadc ↗
- https://pkg.go.dev/vuln/GO-2023-1611 ↗
- https://security.netapp.com/advisory/ntap-20230427-0003/ ↗
- https://github.com/advisories/GHSA-fx2v-qfhr-4chv ↗