Skip to content
OpenAdvisories

Package · Go

github.com/unknwon/cae

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 7.5
    CVE-2020-7668

    Arbitrary File Write via Archive Extraction (Zip Slip)

    In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

    golang-github-unknwon-cae github.com/unknwon/cae Ubuntu Go
  • High 7.5
    CVE-2020-7664

    Arbitrary File Write via Archive Extraction (Zip Slip)

    In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

    github.com/unknwon/cae golang-github-unknwon-cae Ubuntu Go