Go Rpmutils · Go-Rpmutils/Cpio · CVE-2020-7667
**Name of the Vulnerable Software and Affected Versions**
go-rpmutils/cpio version 0.1.0 and earlier
**Description**
The CPIO extraction functionality does not sanitize the paths of the archived files for leading and non-leading `..`, which leads to file extraction outside of the current directory. This is due to improper path sanitization, allowing RPMs containing relative file paths to cause files to be written or overwritten outside of the target directory.
**Recommendations**
For go-rpmutils/cpio version 0.1.0 and earlier, update to version 0.1.0 or later, as the fixing commit was applied to all affected versions which were re-released.