QwikSec

Security Database

CVE

CWE

Training

CVE-2018-1002207

Published: Jul 25, 2018

Modified: Sep 16, 2024

PUBLISHED

Description

mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Vendor	Product	Versions
golang	archiver	affected `unspecified - < e4ef56d48eb029648b0e895bb0b6a393ef0829c3`

Weaknesses (CWE)

References

https://snyk.io/research/zip-slip-vulnerability

x_refsource_MISC

https://github.com/snyk/zip-slip-vulnerability

x_refsource_MISC

https://github.com/mholt/archiver/pull/65

x_refsource_CONFIRM

https://github.com/mholt/archiver/commit/e4ef56d48eb029648b0e895bb0b6a393ef0829c3

x_refsource_CONFIRM

https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMHOLTARCHIVERCMDARCHIVER-50071

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.