PT-2021-12075 · Github.Com/Artdarek/Go Unzip+3 · Github.Com/Artdarek/Go-Unzip+1

Snoopysecurity · Published 2021-04-14 · Updated 2025-04-11 · CVE-2020-36560

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions.

Description: The issue is caused by improper path sanitization, allowing archives with relative file paths to write or overwrite files outside the intended directory. This can lead to unintended file modifications.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-36560

GHSA-RMJ9-Q58G-9QGG

GO-2020-0034

Affected Products

Github.Com/Artdarek/Go-Unzip

Go-Unzip

References · 12

• 🔥 https://github.com/artdarek/go-unzip/pull/2 · Exploit
• https://github.com/artdarek/go-unzip/commit/4975cbe0a719dc50b12da8585f1f207c82f7dfe0 · Patch
• https://osv.dev/vulnerability/GO-2020-0034 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rmj9-q58g-9qgg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36560 · Security Note
• https://github.com/artdarek/go-unzip · Note
• https://t.me/cvenotify/40834 · Telegram Post
• https://snyk.io/research/zip-slip-vulnerability · Note
• https://t.me/cvenotify/118917 · Telegram Post
• https://t.me/cibsecurity/55458 · Telegram Post
• https://pkg.go.dev/vuln/GO-2020-0034 · Note