CVE-2018-1002207
Arbitrary File Write via Archive Extraction in mholt/archiver
Summary
Arbitrary File Write via Archive Extraction in mholt/archiver
Original description
The description as published by the source.
mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
github.com/mholt/archiver
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web snyk.io
- web snyk.io