CVE-2020-7664 — Arbitrary File Write via Archive Extraction (Zip Slip)
In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". T…
Published: 2020-06-17 · CVSS: 7.5 · CVSS 3.1
In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7