https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T03:44:03.441443+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-25664 cnvd-2021-25664 2026-10-18T03:44:03.447109+00:00 cnvd-2021-25664 https://cve.radiocsirt.org/vuln/euvd-2026-181846 EUVD-2026-181846 2026-10-18T03:44:03.447141+00:00 EUVD-2026-181846 https://cve.radiocsirt.org/vuln/fkie_cve-2020-7664 fkie_cve-2020-7664 2026-10-18T03:44:03.447156+00:00

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

 https://cve.radiocsirt.org/vuln/ghsa-vpx7-vm66-qx8r GHSA-vpx7-vm66-qx8r — Path Traversal in github.com/unknwon/cae/zip 2026-10-18T03:44:03.447185+00:00

Affected: Go: github.com/unknwon/cae

The ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.

### Specific Go Packages Affected github.com/unknwon/cae/zip

 https://cve.radiocsirt.org/vuln/gsd-2020-7664 gsd-2020-7664 2026-10-18T03:44:03.447210+00:00 gsd-2020-7664 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-7664 UBUNTU-CVE-2020-7664 2026-10-18T03:44:03.447229+00:00

Affected: Ubuntu:18.04:LTS: golang-github-unknwon-cae, Ubuntu:20.04:LTS: golang-github-unknwon-cae

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.