Nim-Lang · Nim-Lang · CVE-2020-23171
**Name of the Vulnerable Software and Affected Versions**
Nim-lang versions all
**Description**
A vulnerability allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file.
**Recommendations**
For Nim-lang versions all, consider restricting the handling of zip files with dot-slash characters in file names to prevent arbitrary file writing until a patch is available. As a temporary workaround, consider validating and sanitizing zip file contents before processing them.