The wkentaro gdown tool, used for downloading public files and folders from Google Drive, suffers from a CWE-22 path traversal vulnerability in versions before 5.2.2. The vulnerability arises because the extractall function does not properly sanitize or validate filenames inside ZIP or TAR archives, allowing crafted archives to write files outside the target directory. This can lead to arbitrary file overwrite and potentially remote code execution. The vulnerability is addressed in gdown version 5.2.2.

Successful exploitation can result in arbitrary file overwrite on the victim system and potentially remote code execution. This could allow an attacker to modify or replace critical files, leading to compromise of the affected system. There are no known exploits in the wild at this time.

Upgrade to gdown version 5.2.2 or later, which contains a fix for this path traversal vulnerability. No other mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the version update.