-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/dablelv/go-huge-util | go | < 0.0.34 | 0.0.34 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the unzipFile function's handling of zip entry names. The pre-patch code directly joined 'dstDir' and 'file.Name' (path.Join(dstDir, file.Name)), which could contain path traversal sequences. The fix introduced path sanitization via filepath.Join and strings.TrimPrefix to neutralize traversal attempts. Since the commit diff explicitly modifies this function to address the path traversal, and the CVE/GHSA both reference zip.Unzip (which calls unzipFile), this is the definitive vulnerable function.