gdown Affected by Arbitrary File Write via Path Traversal in gdown.extractall

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack within the extractall functionality. When extracting a maliciously crafted ZIP or TAR archive, the library fails to sanitize or validate the filenames of the archive members. This allow files to be written outside the intended destination directory, potentially leading to arbitrary file overwrite and Remote Code Execution (RCE). Version 5.2.2 contains a fix.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

对路径名的限制不恰当(路径遍历)

gdown 安全漏洞

gdown是Kentaro Wada个人开发者的一个谷歌网盘文件下载工具。 gdown 5.2.2之前版本存在安全漏洞，该漏洞源于extractall功能存在路径遍历，可能导致任意文件覆盖和远程代码执行。

N/A

N/A