CVE-2020-7667: Sas Go Rpm Utils

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading ".." which leads in file extraction outside of the current directory. Note: the fixing commit was applied to all affected versions which were re-released.

Affected products

• Sas Go Rpm Utils: before 0.1.0 (fixed in 0.1.0)

Published 2020-06-24. Last modified 2026-06-17.