Description
mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| golang | archiver | unspecified – < e4ef56d48eb029648b0e895bb0b6a393ef0829c3 | e4ef56d48eb029648b0e895bb0b6a393ef0829c3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mholt/archiver | < 2.1.0 | 2.1.0 | GHSA-5wmg-j84w-4jj4 |
| Go | github.com/mholt/archiver | < 2.1.0+incompatible | 2.1.0+incompatible | GO-2022-0799 |