{"id":"CVE-2023-27475","aliases":["EUVD-2023-1005","GHSA-fx2v-qfhr-4chv","GO-2023-1611"],"status":"published","title":"Goutil vulnerable to path traversal when unzipping files","description":"Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version 0.6.0, users are advised to upgrade. There are no known workarounds for this issue.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00849,"percentile":0.58565,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-03-07T17:40:06Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"Go","package":"github.com/gookit/goutil","fixed_in":["0.6.0","0.6.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/gookit/goutil","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gookit/goutil","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gookit/goutil","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.6.7"}]}]}],"products":[{"vendor":"gookit","product":"goutil"},{"vendor":"goutil_project","product":"goutil"}],"references":[{"url":"https://github.com/gookit/goutil/security/advisories/GHSA-fx2v-qfhr-4chv","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/gookit/goutil/commit/d7b94fede71f018f129f7d21feb58c895d28dadc","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20230427-0003/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27475","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1611","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fx2v-qfhr-4chv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27475.json","tags":["advisory"]},{"url":"https://github.com/gookit/goutil","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20230427-0003","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-27475","title":"Goutil vulnerable to path traversal when unzipping files","description":"Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version 0.6.0, users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-03-07T17:40:06.368Z","modified":"2025-02-25T15:00:49.576Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:26.261013Z"}],"euvd":[{"id":"EUVD-2023-1005","description":"Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version 0.6.0, users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-03-07T17:40:06Z","modified":"2025-02-25T15:00:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:24.646946Z"}],"ghsa":[{"id":"GHSA-fx2v-qfhr-4chv","title":"Goutil vulnerable to path traversal when unzipping files","description":"### Impact\n\nZipSlip issue when use fsutil package to unzip files.\nWhen users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. \n\n### Patches\n\nIt has been fixed in v0.6.0, Please upgrade version to v0.6.0 or above.\n\n### Workarounds\nNo, users have to upgrade version.","status":"published","published":"2023-03-07T20:37:09Z","modified":"2023-04-27T15:35:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:36:51.39133Z"}],"nvd":[{"id":"CVE-2023-27475","description":"Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version 0.6.0, users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-03-07T18:15:09.17Z","modified":"2026-06-17T05:45:17.177Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:48.342507Z"}],"osv":[{"id":"CVE-2023-27475","title":"Goutil vulnerable to path traversal when unzipping files","description":"Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version 0.6.0, users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-03-07T17:40:06.368Z","modified":"2026-10-28T02:30:24.346169453Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"GHSA-fx2v-qfhr-4chv","title":"Goutil vulnerable to path traversal when unzipping files","description":"### Impact\n\nZipSlip issue when use fsutil package to unzip files.\nWhen users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. \n\n### Patches\n\nIt has been fixed in v0.6.0, Please upgrade version to v0.6.0 or above.\n\n### Workarounds\nNo, users have to upgrade version.","status":"published","published":"2023-03-07T20:37:09Z","modified":"2023-11-08T04:12:04.357925Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"GO-2023-1611","title":"Path traversal in github.com/gookit/goutil","description":"fsutil.Unzip is vulnerable to path traversal attacks due to improper validation of paths.","status":"published","published":"2023-03-08T19:29:55Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}