Description
Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.
Scores
CVSS v3
7.5
EPSS
0.0060
EPSS Percentile
69.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-22
CWE-61
Status
published
Products (3)
codeclysm/extract
< 4.0.0
codeclysm/extract
0 (2 CPE variants)Go
codeclysm/extract
0 - 4.0.0Go
Published
Oct 11, 2024
Tracked Since
Feb 18, 2026