CVE-2020-7664: Path Traversal in github.com/unknwon/cae/zip
Summary
CVE-2020-7664: Path traversal in github.com/unknwon/cae. Affects github.com/unknwon/cae versions < 1.0.1. Fixed in 1.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/unknwon/cae/zip is a Go library that provides functionality for working with zip archives. It allows users to extract files from zip archives and manipulate them. However, a vulnerability has been discovered in the ExtractTo function of this library, which does not securely escape file paths in zip archives that include leading or non-leading "..". This can be exploited by an attacker to add or replace files system-wide.
Vulnerability Detail
The vulnerability in github.com/unknwon/cae/zip arises from the insecure handling of file paths in zip archives. When extracting files, the ExtractTo function does not properly escape paths that contain leading or non-leading "..". This allows an attacker to traverse directories and potentially overwrite or add files in unintended locations. The impact of this vulnerability is significant as it can lead to unauthorized access, data loss, or even remote code execution.
How To Fix
Latest published version: v1.0.2 as of 23 Oct 2026
go get github.com/unknwon/cae@v1.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.1
This is the first release that contains the fix.
go get github.com/unknwon/cae@v1.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually validate and sanitize file paths before extracting files from zip archives. This can be done by checking for any occurrences of ".." in the path and rejecting or modifying it accordingly. Here is an example of how to sanitize a file path in Go:
func sanitizePath(path string) string {
if strings.Contains(path, "..") {
// Handle or reject the path
}
return path
}
Conclusion
In conclusion, the vulnerability CVE-2020-7664 in github.com/unknwon/cae/zip allows for path traversal attacks when extracting files from zip archives. It is crucial to update the package to version 1.0.1 or later to mitigate this vulnerability. Additionally, users can manually sanitize file paths as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/unknwon/cae →
FAQ
The impact of this vulnerability can be severe. An attacker can exploit it to gain unauthorized access to sensitive files, overwrite critical system files, or even execute arbitrary code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your Gopkg.lock file and provides real-time alerts for open-source vulnerabilities.
Yes, a fix is available for this vulnerability. Users should update their dependencies to the latest version of github.com/unknwon/cae/zip (version 1.0.1 or later) to mitigate the vulnerability.
As a workaround, you can manually validate and sanitize file paths before extracting files from zip archives. This can help prevent path traversal attacks. Refer to the provided code example for guidance.
You can find more information about this vulnerability, including its CVE identifier (CVE-2020-7664), in the advisory published by GitHub at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-vpx7-vm66-qx8r/GHSA-vpx7-vm66-qx8r.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/unknwon/cae.
