CVE-2026-35454— Code Extension Marketplace 路径遍历漏洞

Code Extension Marketplace has a Zip Slip Path Traversal

The Code Extension Marketplace is an open-source alternative to the VS Code Marketplace. Prior to 2.4.2, Zip Slip vulnerability in coder/code-marketplace allowed a malicious VSIX file to write arbitrary files outside the extension directory. ExtractZip passed raw zip entry names to a callback that wrote files via filepath.Join with no boundary check; filepath.Join resolved .. components but did not prevent the result from escaping the base path. This vulnerability is fixed in 2.4.2.

N/A

对路径名的限制不恰当(路径遍历)

Code Extension Marketplace 路径遍历漏洞

Code Extension Marketplace是Coder开源的一个代码编辑器扩展市场服务器。 Code Extension Marketplace 2.4.2之前版本存在路径遍历漏洞，该漏洞源于缺少边界检查，可能导致任意文件写入。

N/A

N/A