CVE-2020-36561

Path traversal in github.com/yi-ge/unzip

Severity Score

9.1

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

*Credits: N/A

CVSS Scores

NISTv3.1 9.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-07-29 CVE Reserved
2022-12-27 CVE Published
2024-07-19 EPSS Updated
2024-08-04 CVE Updated
2024-08-04 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (4)

URL	Tag	Source
https://pkg.go.dev/vuln/GO-2020-0035	Third Party Advisory
https://snyk.io/research/zip-slip-vulnerability	Technical Description

URL	Date	SRC
https://github.com/yi-ge/unzip/pull/1	2024-08-04

URL	Date	SRC
https://github.com/yi-ge/unzip/commit/2adbaa4891b9690853ef10216189189f5ad7dc73	2023-06-08

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Unzip Project Search vendor "Unzip Project"		Unzip Search vendor "Unzip Project" for product "Unzip"				< 1.0.3-0.20200308084313-2adbaa4891b9 Search vendor "Unzip Project" for product "Unzip" and version " < 1.0.3-0.20200308084313-2adbaa4891b9"		go		Affected