Arbitrary File Write via Archive Extraction (Zip Slip)
CVE-2020-7664

7.5HIGH

Key Information:

Vendor: Compression And Archive Extensions Project
Status: Github.com/unknwon/cae/zip
Vendor: CVE Published:; 23 June 2020

🔔 Create Compression And Archive Extensions Project Vulnerability Alert

What is CVE-2020-7664?

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

Affected Version(s)

github.com/unknwon/cae/zip 0

References

https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAEZIP-5...

x_refsource_MISC

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 23, 2020
Vulnerability Reserved
Jan 21, 2020

Credit

Georgios Gkitsas of Snyk Security Team

CVE-2020-7664 Data

JSON