CVE-2020-7667: Arbitrary File Write via Archive Extraction (Zip Slip) in go-rpmutils
Summary
CVE-2020-7667: github.com/sassoftware/go-rpmutils Arbitrary File Write via Archive Extraction (Zip Slip). Affects github.com/sassoftware/go-rpmutils versions < 0.1.0. Fixed in 0.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
go-rpmutils is a Go package that provides functionality for working with RPM (Red Hat Package Manager) files. It allows users to extract and manipulate RPM archives. However, a vulnerability known as Zip Slip exists in the CPIO extraction functionality of go-rpmutils. This vulnerability allows an attacker to write arbitrary files outside of the intended directory during the extraction process.
Vulnerability Detail
The CPIO extraction functionality in go-rpmutils does not properly sanitize the paths of the archived files. This allows an attacker to include leading and non-leading ".." in the file paths, which can result in the extraction of files outside of the current directory. By exploiting this vulnerability, an attacker can overwrite sensitive files or execute arbitrary code on the system. The impact of this vulnerability is high, as it can lead to unauthorized access, data loss, or remote code execution.
How To Fix
Latest published version: v0.4.0 as of 23 Oct 2026
go get github.com/sassoftware/go-rpmutils@v0.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.1.0
This is the first release that contains the fix.
go get github.com/sassoftware/go-rpmutils@v0.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The go-rpmutils package is vulnerable to an arbitrary file write vulnerability known as Zip Slip. This vulnerability allows an attacker to write files outside of the intended directory during the extraction process. To mitigate this issue, users should update to version 0.1.0 or later of go-rpmutils. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/sassoftware/go-rpmutils →
FAQ
go-rpmutils is a Go package that provides functionality for working with RPM (Red Hat Package Manager) files. It allows users to extract and manipulate RPM archives.
Zip Slip is a vulnerability that occurs during the extraction of archive files. It allows an attacker to write files outside of the intended directory by manipulating the file paths within the archive.
The impact of this vulnerability is high, as it can lead to unauthorized access, data loss, or remote code execution.
To fix this vulnerability, users should update to version 0.1.0 or later of go-rpmutils. The fix has been applied to all affected versions.
No, there is no known workaround for this vulnerability. It is recommended to update to the fixed version of go-rpmutils.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
