CVE-2020-7666 - Arbitrary File Write via Archive Extraction (Zip Slip)

Back Back to CVE browser

HIGH

Arbitrary File Write via Archive Extraction (Zip Slip)

Published Sep 1, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.53%

Description

This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based (relative and absolute) path traversal attacks in cpio file extraction.

Affected products

Vendor n/a Product Github.com/u-Root/u-Root/pkg/cpio Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <unspecified

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Github.com/u-Root/u-Root/pkg/cpio

n/a

Version	Status	Constraints
0	affected	<unspecified

Ecosystem	Package	Introduced	Fixed
Go	github.com/u-root/u-root/pkg/cpio	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1250
Advisory
https://github.com/advisories/GHSA-mq35-x99r-54fc
Advisory
https://github.com/u-root/u-root/pull/1817
x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7666
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGCPIO-570440
x_refsource_MISCExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1250		Advisory
https://github.com/advisories/GHSA-mq35-x99r-54fc		Advisory
https://github.com/u-root/u-root/pull/1817		x_refsource_MISCPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7666
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUROOTUROOTPKGCPIO-570440		x_refsource_MISCExploitThird Party Advisory