CVE-2021-3762: Path traversal vulnerability in github.com/quay/claircore
Summary
CVE-2021-3762: Path traversal in github.com/quay/claircore. Affects github.com/quay/claircore versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/quay/claircore, which is written in Go. It is a component used for scanning RPM files. The package provides functionality for scanning and analyzing RPM packages, including extracting metadata and scanning for vulnerabilities. The vulnerability in question allows a maliciously crafted RPM file to exploit the Scanner.Scan function, resulting in the ability to write files with arbitrary contents to arbitrary locations on the local filesystem.
Vulnerability Detail
The path traversal vulnerability in github.com/quay/claircore arises from a flaw in the Scanner.Scan function. By manipulating the RPM file, an attacker can bypass the intended restrictions and write files to unintended locations on the filesystem. This can lead to arbitrary code execution, unauthorized access to sensitive data, or a denial of service. The vulnerability has been assigned the identifier CVE-2021-3762 and is also tracked as GHSA-mq47-6wwv-v79w.
How To Fix
Latest published version: v1.6.1 as of 23 Oct 2026
go get github.com/quay/claircore@v1.6.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
go get github.com/quay/claircore@v1.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, it is advised to exercise caution when processing RPM files from untrusted sources. Implementing input validation and sanitization can help mitigate the risk of exploitation. Additionally, restricting access to the affected package or disabling the functionality that relies on it can also reduce the attack surface.
Conclusion
In conclusion, the github.com/quay/claircore package is vulnerable to a path traversal vulnerability that allows an attacker to write files with arbitrary contents to arbitrary locations on the local filesystem. To mitigate this vulnerability, it is crucial to update the package to version 1.1.0 or later. Implementing input validation and sanitization when processing RPM files from untrusted sources can also help reduce the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/quay/claircore →
FAQ
The vulnerability allows an attacker to write files with arbitrary contents to arbitrary locations on the local filesystem. This can lead to various consequences, including arbitrary code execution, unauthorized access to sensitive data, or a denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fix to mitigate the risk of exploitation.
Yes, a patch is available for this vulnerability. It is recommended to update the github.com/quay/claircore package to version 1.1.0 or later to fix the path traversal vulnerability.
While updating the package is the recommended approach, you can also mitigate the risk by implementing input validation and sanitization when processing RPM files from untrusted sources. Additionally, restricting access to the affected package or disabling the functionality that relies on it can reduce the attack surface.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/quay/claircore.
