Critical severity · published Dec 27, 2022
CVE-2020-36561
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory
9.1
CVSS
1.4%
EPSS
No
On KEV
Description
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Unzip · Unzip Project
before 1.0.3-0.20200308084313-2adbaa4891b9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-36561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-36561
Patch
https://github.com/yi-ge/unzip/commit/2adbaa4891b9690853ef10216189189f5ad7dc73
Exploit
https://github.com/yi-ge/unzip/pull/1
Third Party Advisory
https://pkg.go.dev/vuln/GO-2020-0035
Technical Description
https://snyk.io/research/zip-slip-vulnerability
More from Unzip
7.8
CVE-2014-8141
Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t…
7.8
CVE-2014-8140
Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t…
7.8
CVE-2014-8139
Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command…
7.8
CVE-2018-1000035
A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to…
5.5
CVE-2022-0529
A flaw was found in Unzip