CVE-2020-7669: Arbitrary File Write via Archive Extraction (Zip Slip) in github.com/u-root/u-root/pkg/tarutil
Summary
CVE-2020-7669: github.com/u-root/u-root/pkg/tarutil Arbitrary File Write via Archive Extraction (Zip Slip). Affects github.com/u-root/u-root versions < 0.9.0. Fixed in 0.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/u-root/u-root/pkg/tarutil is a Go package that provides utilities for working with tar files. It is commonly used in various applications for handling file archives. This package is vulnerable to both leading and non-leading relative path traversal attacks during the extraction of tar files. This vulnerability affects all versions up to and including version 7.0.0.
Vulnerability Detail
The vulnerability allows an attacker to perform arbitrary file write operations by exploiting the path traversal vulnerability during the extraction of tar files. By crafting a malicious tar file with specially crafted file paths, an attacker can overwrite arbitrary files on the system. This can lead to unauthorized modification or deletion of critical files, potentially resulting in a complete compromise of the affected system.
How To Fix
Latest published version: v0.16.0 as of 23 Oct 2026
go get github.com/u-root/u-root@v0.16.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.9.0
This is the first release that contains the fix.
go get github.com/u-root/u-root@v0.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional validation checks during the extraction process to prevent path traversal attacks. This can involve validating the file paths within the tar file and ensuring that they are within the expected directory structure. However, it is strongly recommended to apply the official fix by updating the package to a non-vulnerable version.
Conclusion
The package github.com/u-root/u-root/pkg/tarutil is vulnerable to an arbitrary file write vulnerability during the extraction of tar files. This can lead to unauthorized modification or deletion of critical files on the system. It is recommended to update the package to a non-vulnerable version and apply additional validation checks during the extraction process as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/u-root/u-root →
FAQ
This vulnerability allows an attacker to overwrite arbitrary files on the system, potentially leading to unauthorized modification or deletion of critical files.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using Gopkg.lock to analyze the software without requiring access to the code or installation.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the fix as soon as possible to prevent potential exploitation.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide assistance and guidance in addressing this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/u-root/u-root.
