-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the original implementation of extractFromZipFile which directly used zip.File.Name without path sanitization. The commit diff shows the addition of a path validation check using strings.HasPrefix(n, p) to prevent parent directory escapes. The CVE description specifically names this function, and the patch adds both the security check and corresponding test cases to validate() the fix. The vulnerable version joined user-controlled ZIP entry names with the target directory without normalization, enabling directory traversal attacks.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/ollama/ollama | go | < 0.1.47 | 0.1.47 |
Ongoing coverage of React2Shell