Skip to content

archive/zip: can panic when calling Reader.Open #44916

Closed
@katiehockman

Description

@katiehockman

The Reader.Open API, new in Go 1.16, will panic when used on a ZIP archive containing files that start with “../”.

This issue is CVE-2021-27919.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions