CVE-2018-1002207 Arbitrary File Write via Archive Extraction in mholt/archiver
Attackers can write arbitrary files via directory traversal in archive extraction, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1002207?
CVE-2018-1002207 is a medium-severity path traversal vulnerability in golang archiver, published on 25 Jul 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Weakness: CWE-22
Which versions are affected by CVE-2018-1002207?
3 open source packages ship an affected version, including github.com/mholt/archiver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mholt/archiver Go | All versions | 2.1.0 |
github.com/mholt/archiver Go | All versions | 2.1.0 |
github.com/mholt/archiver Go | All versions | 2.1.0+incompatible |
Products include Archiver Project Archiver.
How do I fix CVE-2018-1002207?
Upgrade github.com/mholt/archiver to a fixed version for your release line: 2.1.0 or 2.1.0+incompatible.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-1002207 being exploited?
There is no known exploitation of CVE-2018-1002207 in the wild and no public exploit code.
Other vulnerabilities in golang archiver
Sources
Also known as GHSA-5wmg-j84w-4jj4, GO-2022-0799, SNYK-GOLANG-GITHUBCOMMHOLTARCHIVERCMDARCHIVER-50071.