~ / search / GHSA-v9j4-cp63-qv62

GHSA-v9j4-cp63-qv62

Tarslip in go-unarr

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-38197

Packages

EcosystemPackageAffectedFixed in
Go github.com/gen2brain/go-unarr < 0.1.4 0.1.4

Details

As written in the advisory (Markdown source, shown as plain text).

unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.

References

External links from the advisory. They lead to third-party sites.