CVE-2020-36560: Path traversal in github.com/artdarek/go-unzip
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Other sources
Due to improper path santization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-36560?
CVE-2020-36560 is classified as a medium severity vulnerability due to potential file overwriting risks.
How do I fix CVE-2020-36560?
To fix CVE-2020-36560, upgrade to version 2.0.0 or later of the go-unzip package.
What causes CVE-2020-36560?
CVE-2020-36560 is caused by improper path sanitization allowing archives with relative file paths to write files outside the intended directory.
Which versions of go-unzip are affected by CVE-2020-36560?
CVE-2020-36560 affects all versions of go-unzip below 2.0.0 and specifically versions 1.0.0 and later.
What type of vulnerabilities does CVE-2020-36560 exploit?
CVE-2020-36560 exploits path traversal vulnerabilities that can lead to unauthorized file access and system compromise.