CVE-2020-7669: Arbitrary File Write via Archive Extraction in u-root
Summary
CVE-2020-7669: github.com/u-root/u-root/pkg/tarutil Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/u-root/u-root. Affects github.com/u-root/u-root versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
u-root is an open-source project written in Go that provides a customizable and lightweight initramfs for Linux systems. It aims to simplify the process of creating a bootable Linux environment with minimal dependencies. The package in question, github.com/u-root/u-root, is a part of the u-root project and is responsible for handling archive extraction, including the extraction of zip files.
Vulnerability Detail
The vulnerability, known as Zip Slip, allows an attacker to overwrite arbitrary files during the extraction process of a maliciously crafted archive. By manipulating the paths of the files within the archive, an attacker can escape the intended extraction directory and overwrite sensitive files on the system. This can lead to various security issues, including remote code execution, privilege escalation, and data loss.
How To Fix
Latest published version: v0.16.0 as of 23 Oct 2026
go get github.com/u-root/u-root@v0.16.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.0
This is the first release that contains the fix.
go get github.com/u-root/u-root@v0.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually validate and sanitize the paths of the extracted files before writing them to the file system. This can be done by implementing proper path validation checks and ensuring that the extracted files are written only to the intended directory.
Conclusion
The vulnerability CVE-2020-7669 in the u-root package allows for arbitrary file write during archive extraction, potentially leading to severe security issues. It is crucial to update to version 0.9.0 or later to patch the vulnerability. Additionally, implementing proper path validation and sanitization can serve as a workaround until the update is applied.
See every vulnerability recorded for github.com/u-root/u-root →
FAQ
u-root is an open-source project that provides a customizable and lightweight initramfs for Linux systems. It simplifies the process of creating a bootable Linux environment with minimal dependencies.
Zip Slip is a vulnerability that allows an attacker to overwrite arbitrary files during the extraction process of a maliciously crafted archive. By manipulating the paths of the files within the archive, an attacker can escape the intended extraction directory and overwrite sensitive files on the system.
The consequences of this vulnerability include remote code execution, privilege escalation, and data loss. An attacker could overwrite critical system files, execute arbitrary code, or gain elevated privileges on the affected system.
To fix this vulnerability, update the u-root package to version 0.9.0 or later. This update includes proper path validation and sanitization during the archive extraction process, mitigating the risk of Zip Slip attacks.
As a workaround, users can manually validate and sanitize the paths of the extracted files before writing them to the file system. Implementing proper path validation checks and ensuring that the extracted files are written only to the intended directory can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/u-root/u-root.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
