codeclysm github.com/codeclysm/extract/v3 vulnerabilities

Latest codeclysm github.com/codeclysm/extract/v3 CVEs

Newest publication first

1. CVE-2024-47877 Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.

   Published 2024-10-11

   Medium·CVSS 6.9 EPSS 0.55%

   Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.