What is GHSA-r887-gfxh-m9rr?

GHSA-r887-gfxh-m9rr is a security advisory published by GitHub Security Advisories with High severity. mrpack-install vulnerable to path traversal with dependency

Which CVE IDs does GHSA-r887-gfxh-m9rr cover?

GHSA-r887-gfxh-m9rr covers the following CVE IDs: CVE-2023-25307. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r887-gfxh-m9rr?

GHSA-r887-gfxh-m9rr has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-r887-gfxh-m9rr?

GHSA-r887-gfxh-m9rr affects 1 product, including: go/github.com/nothub/mrpack-install:\u003c= 0.16.2.

GHSA-r887-gfxh-m9rrHighCVSS 8.8

mrpack-install vulnerable to path traversal with dependency

Vendor

GitHub Security Advisories

Published

February 8, 2023

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-25307 →

📋 Description

Impact

Importing a malicious .mrpack file can cause path traversal while downloading files. This can lead to scripts or config files being placed or replaced at arbitrary locations, without the user noticing.

Patches

No patches yet.

Workarounds

Avoid importing .mrpack files from untrusted sources.

References

https://docs.modrinth.com/docs/modpacks/format_definition/#files

🎯 Affected products1

go/github.com/nothub/mrpack-install:<= 0.16.2

🔗 References (6)

https://github.com/nothub/mrpack-install/security/advisories/GHSA-r887-gfxh-m9rr
https://github.com/nothub/mrpack-install/commit/a1f424b6a616d2de95228781eef3b92b9769f23c
https://github.com/nothub/mrpack-install/releases/tag/v0.16.3
https://nvd.nist.gov/vuln/detail/CVE-2023-25307
https://quiltmc.org/en/blog/2023-02-04-five-installer-vulnerabilities/
https://github.com/advisories/GHSA-r887-gfxh-m9rr