High severity · published Dec 3, 2020
CVE-2020-29529
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of…
7.5
CVSS
2.8%
EPSS
No
On KEV
Description
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
Go-slug · Hashicorp
before 0.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-29529
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-29529
Patch
https://github.com/hashicorp/go-slug/compare/v0.4.3...v0.5.0
Patch
https://github.com/hashicorp/go-slug/pull/12
Release Notes
https://github.com/hashicorp/go-slug/releases/tag/v0.5.0
Exploit
https://securitylab.github.com/advisories/GHSL-2020-262-zipslip-go-slug
More from Go-slug
9.1
CVE-2025-0377
HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry
5.5
CVE-2026-14978
Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions