{"id":"GHSA-8x9r-hvwg-c55h","summary":"Code Extension Marketplace: Zip Slip Path Traversal","details":"# Zip Slip Path Traversal in coder/code-marketplace\n\n## Summary\n\nA Zip Slip (CWE-22) vulnerability in `coder/code-marketplace` ≤ v2.4.1 allowed a malicious VSIX file to write arbitrary files outside the extension directory. `ExtractZip` passed raw zip entry names to a callback that wrote files via `filepath.Join` with no boundary check; `filepath.Join` resolved `..` components but did not prevent the result from escaping the base path.\n\n\n## Root Cause\n\n`ExtractZip` passed the raw, attacker-controlled `zf.Name` to a caller-supplied callback:\n\n```go\nreturn false, fn(zf.Name, zr)  // zf.Name not sanitized\n```\n\n`AddExtension` constructed the output path with `filepath.Join` and no boundary check:\n\n```go\npath := filepath.Join(dir, name)              // zip loop\npath := filepath.Join(dir, file.RelativePath) // extra files loop\n```\n\n`filepath.Clean` resolved `..` lexically but did not confine the result to `dir`:\n\n```\nfilepath.Join(\"/srv/ext/pub/1.0\", \"../../../../etc/cron.d/evil\")\n  → \"/etc/cron.d/evil\"\n```\n\n## Attack Scenario\n\nAn authenticated user (any upload-capable role) would submit a VSIX containing path-traversal entries.\n\nOn extraction, files would land at attacker-chosen paths writable by the marketplace process, enabling persistence (cron/init injection), SSH key injection, `ld.so.preload` hijacking, or binary overwrite depending on process privileges.\n\n## Fix\n\nAddressed in https://github.com/coder/code-marketplace/releases/tag/v2.4.2\n\n## Recognition\nCoder would like to thank [Kandlaguduru Vamsi](https://www.linkedin.com/in/vamsi-k-5419632a9/) for responsibly disclosing this issue in accordance with https://coder.com/security/policy","aliases":["CVE-2026-35454","GO-2026-5270"],"modified":"2026-06-25T19:56:08.232001451Z","published":"2026-04-04T06:26:02Z","database_specific":{"nvd_published_at":"2026-04-06T22:16:23Z","cwe_ids":["CWE-22"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-04-04T06:26:02Z"},"references":[{"type":"WEB","url":"https://github.com/coder/code-marketplace/security/advisories/GHSA-8x9r-hvwg-c55h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35454"},{"type":"WEB","url":"https://github.com/coder/code-marketplace/commit/988440dee05fceef8400ed725badc604dbf90792"},{"type":"PACKAGE","url":"https://github.com/coder/code-marketplace"},{"type":"WEB","url":"https://github.com/coder/code-marketplace/releases/tag/v2.4.2"}],"affected":[{"package":{"name":"github.com/coder/code-marketplace","ecosystem":"Go","purl":"pkg:golang/github.com/coder/code-marketplace"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.2.3-0.20260402184705-988440dee05f"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-8x9r-hvwg-c55h/GHSA-8x9r-hvwg-c55h.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}