CVE-2023-27475: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

March 7, 2023 (updated April 27, 2023)

Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version 0.6.0, users are advised to upgrade. There are no known workarounds for this issue.

References

github.com/advisories/GHSA-fx2v-qfhr-4chv
github.com/gookit/goutil/commit/d7b94fede71f018f129f7d21feb58c895d28dadc
github.com/gookit/goutil/security/advisories/GHSA-fx2v-qfhr-4chv
nvd.nist.gov/vuln/detail/CVE-2023-27475

Code Behaviors & Features

Detect and mitigate CVE-2023-27475 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →