Arbitrary File Write via Archive Extraction (Zip Slip)
CVE-2020-7668

7.5HIGH

Key Information:

Vendor: Compression And Archive Extensions Tz Project
Status: Github.com/unknwon/cae/tz
Vendor: CVE Published:; 23 June 2020

🔔 Create Compression And Archive Extensions Tz Project Vulnerability Alert

What is CVE-2020-7668?

In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

Affected Version(s)

github.com/unknwon/cae/tz 0

References

https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAETZ-57...

x_refsource_MISC

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 23, 2020
Vulnerability Reserved
Jan 21, 2020

Credit

Georgios Gkitsas of Snyk Security Team

CVE-2020-7668 Data

JSON