CVE-2022-41920CWE-22

Zip slip in Lancet

Medium · published November 17, 2022

CVSS v3.1
6.3
EPSS
1%
Percentile
57.6
In the wild
Unconfirmed
What it is

Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00847 · 57.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-11-17T00:00Z
EPSS history
Timeline
  • 17 NOV 00:00Z
    Zip slip in Lancet
    cvelistv5