GHSA-xphh-5v4r-r3rx: PsiTransfer has Zip Slip Path Traversal via TAR Archive Download
A Zip Slip vulnerability in PsiTransfer allows an unauthenticated attacker to upload files with path traversal sequences in the filename (e.g. ../../../.ssh/authorized_keys). When a victim downloads the bucket as a .tar.gz archive and extracts it, malicious files are written outside the intended directory, potentially leading to RCE.
References
Code Behaviors & Features
Detect and mitigate GHSA-xphh-5v4r-r3rx with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →