{"id":"CVE-2026-35454","aliases":["GHSA-8x9r-hvwg-c55h","GO-2026-5270"],"url":"https://o3.security/vulnerability/CVE-2026-35454","summary":"Code Extension Marketplace has a Zip Slip Path Traversal","details":"# Zip Slip Path Traversal in coder/code-marketplace\n\n## Summary\n\nA Zip Slip (CWE-22) vulnerability in `coder/code-marketplace` ≤ v2.4.1 allowed a malicious VSIX file to write arbitrary files outside the extension directory. `ExtractZip` passed raw zip entry names to a callback that wrote files via `filepath.Join` with no boundary check; `filepath.Join` resolved `..` components but did not prevent the result from escaping the base path.\n\n\n## Root Cause\n\n`ExtractZip` passed the raw, attacker-controlled `zf.Name` to a caller-supplied callback:\n\n```go\nreturn false, fn(zf.Name, zr)  // zf.Name not sanitized\n```\n\n`AddExtension` constructed the output path with `filepath.Join` and no boundary check:\n\n```go\npath := filepath.Join(dir, name)              // zip loop\npath := filepath.Join(dir, file.RelativePath) // extra files loop\n```\n\n`filepath.Clean` resolved `..` lexically but did not confine the result to `dir`:\n\n```\nfilepath.Join(\"/srv/ext/pub/1.0\", \"../../../../etc/cron.d/evil\")\n  → \"/etc/cron.d/evil\"\n```\n\n## Attack Scenario\n\nAn authenticated user (any upload-capable role) would submit a VSIX containing path-traversal entries.\n\nOn extraction, files would land at attacker-chosen paths writable by the marketplace process, enabling persistence (cron/init injection), SSH key injection, `ld.so.preload` hijacking, or binary overwrite depending on process privileges.\n\n## Fix\n\nAddressed in https://github.com/coder/code-marketplace/releases/tag/v2.4.2\n\n## Recognition\nCoder would like to thank [Kandlaguduru Vamsi](https://www.linkedin.com/in/vamsi-k-5419632a9/) for responsibly disclosing this issue in accordance with https://coder.com/security/policy","published":"2026-04-06T21:51:53.048Z","modified":"2026-08-29T03:46:11.647967353Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/coder/code-marketplace","fixedVersion":"1.2.3-0.20260402184705-988440dee05f"}],"fix":{"url":"https://github.com/coder/code-marketplace/commit/988440dee05fceef8400ed725badc604dbf90792","label":"coder/code-marketplace@988440d"},"references":[{"type":"WEB","url":"https://github.com/coder/code-marketplace/releases/tag/v2.4.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35454.json"},{"type":"ADVISORY","url":"https://github.com/coder/code-marketplace/security/advisories/GHSA-8x9r-hvwg-c55h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35454"},{"type":"WEB","url":"https://github.com/coder/code-marketplace/commit/988440dee05fceef8400ed725badc604dbf90792"},{"type":"PACKAGE","url":"https://github.com/coder/code-marketplace"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-29T03:46:11.647967353Z"}}