-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| python-libarchive | pip | <= 4.2.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper path sanitization in the extract method (line 107 in zip.py), where os.path.join(path, name) is used with untrusted name values from ZIP entries. This allows absolute paths or traversal sequences to escape the target directory. The extractall method is vulnerable because it relies on extract. The GitHub issue (#42) and fix in PR #41 confirm the vulnerable functions and their insecure use of os.path.join.