Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability allows an attacker to create symlinks outside the extraction directory using a maliciously crafted archive. The provided commit 4a98568021b8e289345c7f526ccbd7ed732cf286 patches this vulnerability in extractor.go.
The (*Extractor).Tar and (*Extractor).Zip methods are responsible for handling Tar and Zip archives, respectively.
In (*Extractor).Tar, the use of filepath.Join (before being replaced by safeJoin) for constructing file paths was a potential path traversal vector. More specifically for symlinks, the target of the symlink (header.Linkname) was used in e.FS.Symlink without proper validation to ensure it was within the bounds of the extraction directory.
In (*Extractor).Zip, a similar issue existed where the target of a symlink (read from the symlink file's content) was used in e.FS.Symlink without sufficient validation against the extraction directory.
The patch rectifies these issues by introducing safeJoin for safer path construction and a new centralized function extractSymlinks which is presumed to perform stricter validation before creating symlinks. The vulnerable functions are thus (*Extractor).Tar and (*Extractor).Zip in their pre-patch state, as they contained the logic that processed potentially malicious archive paths and symlink targets without sufficient checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/codeclysm/extract/v3 | go | <= 3.1.1 | |
| github.com/codeclysm/extract/v4 | go | < 4.0.0 | 4.0.0 |
| github.com/codeclysm/extract | go | <= 2.2.0 |
