{"id":"CVE-2023-28105","aliases":["EUVD-2023-0883","GHSA-5g39-ppwg-6xx8","GO-2023-1640"],"status":"published","title":"Go-huge-util vulnerable to path traversal when unzipping files","description":"go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use `zip.Unzip` to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00614,"percentile":0.4988,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-03-16T16:26:34Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Go","package":"github.com/dablelv/go-huge-util","fixed_in":["0.0.34"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/dablelv/go-huge-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.34"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/dablelv/go-huge-util","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.34"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/dablelv/go-huge-util","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.34"}]}]}],"products":[{"vendor":"dablelv","product":"go-huge-util"},{"vendor":"go-huge-util_project","product":"go-huge-util"}],"references":[{"url":"https://github.com/dablelv/go-huge-util/security/advisories/GHSA-5g39-ppwg-6xx8","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/dablelv/go-huge-util/commit/0e308b0fac8973e6fa251b0ab095cdc5c1c0956b","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28105","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2023-1640","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5g39-ppwg-6xx8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28105.json","tags":["advisory"]},{"url":"https://github.com/dablelv/go-huge-util","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-28105","title":"Go-huge-util vulnerable to path traversal when unzipping files","description":"go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use `zip.Unzip` to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.","status":"published","published":"2023-03-16T16:26:34.669Z","modified":"2025-02-25T14:55:23.289Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:32.376766Z"}],"euvd":[{"id":"EUVD-2023-0883","description":"go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use `zip.Unzip` to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.","status":"published","published":"2023-03-16T16:26:34Z","modified":"2025-02-25T14:55:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T20:53:24.646946Z"}],"ghsa":[{"id":"GHSA-5g39-ppwg-6xx8","title":"Go-huge-util vulnerable to path traversal when unzipping files","description":"Impact\nZipSlip issue when use fsutil package to unzip files.\nWhen users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal.\n\nPatches\nIt has been fixed in v0.0.34, Please upgrade version to v0.0.34 or above.\n\nWorkarounds\nNo, users have to upgrade version.\n\nSpecific Go Packages Affected\ngithub.com/dablelv/go-huge-util/zip\n\nReferences","status":"published","published":"2023-03-16T18:32:38Z","modified":"2023-10-02T10:43:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:06.913882Z"}],"nvd":[{"id":"CVE-2023-28105","description":"go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use `zip.Unzip` to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.","status":"published","published":"2023-03-16T17:15:09.483Z","modified":"2026-06-17T05:46:52.95Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:07:49.031498Z"}],"osv":[{"id":"CVE-2023-28105","title":"Go-huge-util vulnerable to path traversal when unzipping files","description":"go-used-util has commonly used utility functions for Go. Versions prior to 0.0.34 have a ZipSlip issue when using fsutil package to unzip files. When users use `zip.Unzip` to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. The issue has been fixed in version 0.0.34. There are no known workarounds.","status":"published","published":"2023-03-16T16:26:34.669Z","modified":"2026-10-28T02:30:33.89389857Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"GHSA-5g39-ppwg-6xx8","title":"Go-huge-util vulnerable to path traversal when unzipping files","description":"Impact\nZipSlip issue when use fsutil package to unzip files.\nWhen users use zip.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal.\n\nPatches\nIt has been fixed in v0.0.34, Please upgrade version to v0.0.34 or above.\n\nWorkarounds\nNo, users have to upgrade version.\n\nSpecific Go Packages Affected\ngithub.com/dablelv/go-huge-util/zip\n\nReferences","status":"published","published":"2023-03-16T18:32:38Z","modified":"2023-11-08T04:12:08.557968Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GO-2023-1640","title":"Path traversal when unzipping files in github.com/dablelv/go-huge-util","description":"Path traversal when unzipping files in github.com/dablelv/go-huge-util","status":"published","published":"2023-08-23T14:38:02Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}