GHSA-32qh-8vg6-9g43

Cloud Foundry Archiver vulnerable to path traversal

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-25046

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/cloudfoundry/archiver	< 0.0.0-20180523222229-09b5706aa936	0.0.0-20180523222229-09b5706aa936
Go	code.cloudfoundry.org/archiver	< 0.0.0-20180523222229-09b5706aa936	0.0.0-20180523222229-09b5706aa936

Details

As written in the advisory (Markdown source, shown as plain text).

Due to improper path santization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-25046 advisory
https://github.com/cloudfoundry/archiver/commit/09b5706aa9367972c09144a450bb4523049ee840 web
https://github.com/cloudfoundry/archiver package
https://pkg.go.dev/vuln/GO-2020-0025 web
https://snyk.io/research/zip-slip-vulnerability web