CVE-2020-7665: Path Traversal Vulnerability in u-root
Summary
CVE-2020-7665: Path traversal in u-root. Affects github.com/u-root/u-root versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
u-root is an open-source project written in Go that provides a root file system containing a collection of Go-based Linux tools. It aims to create a simple and customizable initramfs (initial RAM file system) for Linux. The package affected by this vulnerability is 'github.com/u-root/u-root/pkg/uzip'. The uzip package is responsible for extracting zip files. However, it is vulnerable to both leading and non-leading relative path traversal attacks during the extraction process.
Vulnerability Detail
The path traversal vulnerability in u-root's uzip package allows an attacker to manipulate the path of the extracted files within a zip archive. By crafting a malicious zip file with specially crafted file paths, an attacker can overwrite or extract files to unintended locations on the file system. This can lead to unauthorized access, data leakage, or even remote code execution depending on the context in which the extracted files are used. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: v0.16.0 as of 23 Oct 2026
go get github.com/u-root/u-root@v0.16.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.0
This is the first release that contains the fix.
go get github.com/u-root/u-root@v0.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization when processing zip files. This can involve checking the file paths within the zip archive and ensuring they are within the intended extraction directory. Additionally, limiting the permissions of the user running the u-root tool can help mitigate the impact of a successful attack.
Conclusion
The path traversal vulnerability in u-root's uzip package can have serious security implications, allowing attackers to manipulate file paths during zip file extraction. It is crucial for developers using u-root to update their packages to version 0.9.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/u-root/u-root →
FAQ
u-root is an open-source project that provides a customizable initramfs for Linux, containing a collection of Go-based Linux tools.
The uzip package is a part of u-root and is responsible for extracting zip files.
A path traversal attack, also known as directory traversal or directory climbing, is a web security vulnerability that allows an attacker to access files and directories outside of the intended directory structure.
The path traversal vulnerability in u-root's uzip package can lead to unauthorized access, data leakage, or remote code execution, depending on the context in which the extracted files are used.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/u-root/u-root.
