Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
Résumé
Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com