CVE-2023-28105
Go-huge-util vulnerable to path traversal when unzipping files
go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Go-huge-util vulnerable to path traversal when unzipping files
go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.
- Record
CVE-2023-28105- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2023-0883
go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.
- Record
EUVD-2023-0883- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5g39-ppwg-6xx8
Go-huge-util vulnerable to path traversal when unzipping files
Impact ZipSlip issue when use fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal.
Patches It has been fixed in v0.0.34, Please upgrade version to v0.0.34 or above.
Workarounds No, users have to upgrade version.
Specific Go Packages Affected github.com/dablelv/go-huge-util/zip
References
- Record
GHSA-5g39-ppwg-6xx8- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.
- Record
CVE-2023-28105- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
Go-huge-util vulnerable to path traversal when unzipping files
go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.
- Record
CVE-2023-28105- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-5g39-ppwg-6xx8
Go-huge-util vulnerable to path traversal when unzipping files
Impact ZipSlip issue when use fsutil package to unzip files. When users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal.
Patches It has been fixed in v0.0.34, Please upgrade version to v0.0.34 or above.
Workarounds No, users have to upgrade version.
Specific Go Packages Affected github.com/dablelv/go-huge-util/zip
References
- Record
GHSA-5g39-ppwg-6xx8- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGO-2023-1640 No score
Path traversal when unzipping files in github.com/dablelv/go-huge-util
Path traversal when unzipping files in github.com/dablelv/go-huge-util
- Record
GO-2023-1640- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/dablelv/go-huge-utilGo |
before 0.0.34 | 0.0.34 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-28105 is a high vulnerability (CVSS 8.8) in Dablelv Go-huge-util, published March 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in github.com/dablelv/go-huge-util 0.0.34.
References
github.com/dablelv/go-huge-util/security/advisories/GHSA-5g39-ppwg-6xx8
nvd.nist.gov/vuln/detail/CVE-2023-28105
pkg.go.dev/vuln/GO-2023-1640