CVE-2020-7664: Path Traversal in github.com/unknwon/cae/zip
Summary
CVE-2020-7664: Path Traversal in github.com/unknwon/cae/zip. Affects github.com/unknwon/cae versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/unknwon/cae is a Go package that provides functionality for working with zip archives. It allows users to extract files from zip archives and perform various operations on them. However, a vulnerability has been discovered in the package's ExtractTo function, which does not securely escape file paths in zip archives that include leading or non-leading "..". This can be exploited by an attacker to add or replace files system-wide.
Vulnerability Detail
The vulnerability in github.com/unknwon/cae/zip arises from the insecure handling of file paths in zip archives. When extracting files, the ExtractTo function does not properly sanitize paths that contain leading or non-leading "..". This allows an attacker to traverse directories and potentially overwrite or add files in unintended locations. The impact of this vulnerability can be severe, as it can lead to unauthorized access, data loss, or even remote code execution.
How To Fix
Latest published version: v1.0.2 as of 23 Oct 2026
go get github.com/unknwon/cae@v1.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.1
This is the first release that contains the fix.
go get github.com/unknwon/cae@v1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of the github.com/unknwon/cae package as soon as possible.
Conclusion
The vulnerability in github.com/unknwon/cae/zip allows an attacker to perform path traversal and potentially overwrite or add files system-wide. To mitigate this vulnerability, it is crucial to update to version 1.0.1 or later of the github.com/unknwon/cae package. Users can use the Vulert playground at https://vulert.com/scanner to check if their application is affected and take appropriate actions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/unknwon/cae →
FAQ
The impact of this vulnerability can be severe, as it allows an attacker to add or replace files system-wide. This can lead to unauthorized access, data loss, or even remote code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a fix is available in version 1.0.1 or later of the github.com/unknwon/cae package. It is recommended to update your dependencies to the latest version to mitigate the vulnerability.
There are no known workarounds for this vulnerability. It is recommended to update to the latest version of the github.com/unknwon/cae package as soon as possible.
Yes, this vulnerability can be exploited remotely. An attacker can craft a malicious zip archive and trick a user or application into extracting it, leading to the traversal of directories and potential file manipulation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/unknwon/cae.
