CVE-2023-28105

CVE-2023-28105 is a high-severity ZipSlip vulnerability affecting go-used-util versions prior to 0.0.34, specifically within its fsutil package when unzipping files. An unauthenticated attacker can exploit this via a crafted malicious zip file, leading to path traversal and potential compromise of confidentiality, integrity, and availability of the system. While no active exploitation, public exploit code, or significant community discussion has been observed, the vulnerability is easily exploitable with low attack complexity. The issue is resolved in version 0.0.34, and no workarounds exist.