What’s Vulnerable › Vulnerabilities

CVE-2024-47877: Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-11 · updated 2026-06-17
• Weakness: CWE-22

Description

Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.

Affected products

• codeclysm extract: before 4.0.0 — fixed in 4.0.0

How to fix

Upgrade to a fixed version: codeclysm extract 4.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/codeclysm/extract/commit/4a98568021b8e289345c7f526ccbd7ed732cf286
• https://github.com/codeclysm/extract/security/advisories/GHSA-8rm2-93mq-jqhc

Get alerted when CVE-2024-47877 or the next vulnerability affects your stack