CVE-2023-27475

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Goutil is a collection of miscellaneous functionality for the go language. In versions prior to 0.6.0 when users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. This vulnerability is known as a ZipSlip. This issue has been fixed in version 0.6.0, users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Mar 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-274767.5OWSLib is a Python package for client programming with Open Geospatial Consortium (OGC) web service interface standards, and their related cCVE-2023-274774.3wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's code generation backend, Cranelift, has a bug on x86_64 platforms for the CVE-2023-274786.5libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previCVE-2023-274799.9XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2023-274807.7XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2023-274814.3Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the `CVE-2023-2748210.0homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the SupervCVE-2023-274837.5crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory paniCVE-2023-274844.9crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions CVE-2023-274854.3thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to qCVE-2023-274868.8xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanismCVE-2023-274879.1Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and