-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/cloudfoundry/archiver | go | < 0.0.0-20180523222229-09b5706aa936 | 0.0.0-20180523222229-09b5706aa936 |
| code.cloudfoundry.org/archiver | go | < 0.0.0-20180523222229-09b5706aa936 | 0.0.0-20180523222229-09b5706aa936 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insecure path construction in archive extraction functions. The patch replaced filepath.Join() with securejoin.SecureJoin() in these specific functions, and added tests verifying that '../' paths are now blocked. The Go vulnerability report (GO-2020-0025) explicitly lists these unexported functions as affected symbols. Both functions directly handle archive entry paths and were missing path sanitization, making them the root cause of the traversal vulnerability.
A Semantic Attack on Google Gemini - Read the Latest Research