LiveActive security incident?Get immediate response
CVE Record

CVE-2020-7664: Arbitrary File Write via Archive Extraction (Zip Slip)

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2020-7664 is a Zip Slip flaw in github.com/unknwon/cae/zip. If an application extracts attacker-controlled ZIP files with ExtractTo, crafted archive paths can write files outside the intended folder. Business impact is integrity-focused: unauthorized file creation or replacement, potentially affecting application behavior or system configuration.

Executive priority

Prioritize remediation where ZIP upload, import, backup, or integration workflows touch production systems. The issue is not listed as actively exploited in the supplied sources, but arbitrary file write is a serious integrity risk and should not remain in exposed ingestion paths.

Technical view

The ExtractTo function does not securely escape archive entries containing leading or embedded ".." path traversal segments. During extraction, those paths can resolve outside the target directory, allowing arbitrary file writes. The supplied bundle identifies all versions of github.com/unknwon/cae/zip as affected and gives CVSS 3.1 score 7.5.

Likely exposure

Exposure is limited to Go applications that import github.com/unknwon/cae/zip and use ExtractTo on ZIP archives from users, partners, automated feeds, or other untrusted sources. Systems not using this package or not extracting untrusted ZIPs are unlikely to be exposed.

Exploitation context

The bundle marks KEV as false, so there is no supplied evidence of known active exploitation. The CVSS vector includes proof-of-concept maturity, but no exploit details are needed to understand the risk: malicious archive paths can cause unintended file writes during extraction.

Researcher notes

Key unknowns remain: the supplied bundle does not name a patched version, CWE mapping, or vendor mitigation details. Treat findings as source-scoped. Validate real-world impact by mapping package usage, trust boundaries, filesystem permissions, and whether written files could influence application execution or configuration.

Mitigation direction

  • Inventory applications using github.com/unknwon/cae/zip.
  • Check Snyk and upstream guidance for a safe replacement or fix.
  • Avoid ExtractTo for untrusted ZIP archives until remediated.
  • Use an extraction library that validates canonical destination paths.
  • Run extraction with least-privileged filesystem permissions.

Validation and detection

  • Search dependency manifests for github.com/unknwon/cae/zip.
  • Review code paths calling ExtractTo.
  • Identify whether archives can originate from untrusted users or feeds.
  • Confirm extraction targets cannot escape the intended directory.
  • Verify remediation with safe-path regression tests.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

File access behavior lookup

The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-7664 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:U/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:U/RC:C3.93.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2020-7664Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:P/RL:U/RC:C

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/agithub.com/unknwon/cae/zip0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.