VDB
Sign up
HIGH8.8

GHSA-fx2v-qfhr-4chv

Goutil vulnerable to path traversal when unzipping files

Quick fix

GHSA-fx2v-qfhr-4chv — github.com/gookit/goutil: upgrade to the fixed version with the command below.

go get github.com/gookit/goutil@v0.6.0

Details

### Impact

ZipSlip issue when use fsutil package to unzip files. When users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal.

### Patches

It has been fixed in v0.6.0, Please upgrade version to v0.6.0 or above.

### Workarounds No, users have to upgrade version.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/gookit/goutil
Introduced in: 0Fixed in: 0.6.0
Fixgo get github.com/gookit/goutil@v0.6.0

References