Unzip vulnerable to path traversal

CRÍTICO 9.1CVE-2020-36561 · GHSA-f5c5-hmw9-v8hx · GO-2020-0035 · Published 27/12/2022 · updated 17/06/2026

En resumen

CVE-2020-36561 es una vulnerabilidad CRÍTICO (CVSS 9.1) que afecta a github.com/yi-ge/unzip, unzip (unzip project).
Probabilidad de explotación en los próximos 30 días (EPSS): 1.4%, mayor que el 72.7% de las vulnerabilidades.
Solución: actualizar a 1.0.3-0.20200308084313-2adbaa4891b9 o posterior.

Package	Affected versions	Patched versions
github.com/yi-ge/unzip Go	`< 1.0.3-0.20200308084313-2adbaa4891b9`	`1.0.3-0.20200308084313-2adbaa4891b9`
unzip unzip_project	`< 1.0.3-0.20200308084313-2adbaa4891b9`	`1.0.3-0.20200308084313-2adbaa4891b9`

Description

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

NVD description

Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

References

nvd.nist.gov/vuln/detail/CVE-2020-36561 · ADVISORY
yi-ge/unzip#1 · WEB
yi-ge/unzip commit 2adbaa4 · WEB
yi-ge/unzip · PACKAGE
pkg.go.dev/vuln/GO-2020-0035 · WEB
snyk.io/research/zip-slip-vulnerability · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free