CVE-2020-7668: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

May 18, 2021 (updated February 16, 2023)

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function does not securely escape file paths in zip archives which include leading or non-leading “..”. This allows an attacker to add or replace files system-wide.

References

github.com/advisories/GHSA-88jf-7rch-32qc
github.com/unknwon/cae/commit/07971c00a1bfd9dc171c3ad0bfab5b67c2287e11
nvd.nist.gov/vuln/detail/CVE-2020-7668
pkg.go.dev/vuln/GO-2020-0041
snyk.io/research/zip-slip-vulnerability
snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAETZ-570384

Code Behaviors & Features

Detect and mitigate CVE-2020-7668 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →