CVE-2020-7668:
github.com/unknwon/cae Path Traversal vulnerability
7.5
CVSS ScoreBasic Information
GoTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/unknwon/cae | go | < 1.0.1 | 1.0.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The core vulnerability stems from insecure path handling in extraction functions across both tar (tz) and zip implementations. The commit diff shows critical fixes in ExtractToFunc methods where:
- Backslash replacement was upgraded to strings.ReplaceAll (minor)
- cae.Clean() was added to resolve path traversal sequences via path.Clean()
These functions directly process archive entry names during extraction. The GHSA/CVE descriptions explicitly call out ExtractTo as vulnerable, and Go's vulnerability database (GO-2020-0041) lists ExtractTo/ExtractToFunc as affected symbols. While syncFiles and Open aren't extraction endpoints themselves, they process filenames early in the pipeline, contributing to the vulnerability chain. Confidence is high for ExtractToFunc methods due to their direct role in path handling during extraction, and medium for initialization functions due to their indirect role.