-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/artdarek/go-unzip | go | < 2.0.0 | 2.0.0 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from the Extract method in unzip.go which handled zip entry names without adequate path validation. The GitHub patch adds a critical path sanitization check (strings.HasPrefix) to this exact function, confirming it was the vulnerable point. The CVE description and Go vulnerability report (GO-2020-0034) explicitly reference this function as the affected component. The pre-patch code joined user-controlled filenames with the target directory without verifying if the resulting path remained within the designated directory boundary.
Ongoing coverage of React2Shell