The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2021-0228" }
{ "imports": [ { "path": "github.com/unknwon/cae/tz", "symbols": [ "Create", "ExtractTo", "Open", "OpenFile", "TzArchive.Close", "TzArchive.ExtractTo", "TzArchive.ExtractToFunc", "TzArchive.Flush", "TzArchive.Open", "TzArchive.syncFiles" ] }, { "path": "github.com/unknwon/cae/zip", "symbols": [ "Create", "ExtractTo", "ExtractToFunc", "Open", "OpenFile", "ZipArchive.Close", "ZipArchive.ExtractTo", "ZipArchive.ExtractToFunc", "ZipArchive.Flush", "ZipArchive.Open" ] } ] }