The gdown tool, used for downloading public files from Google Drive, suffers from a CWE-22 path traversal vulnerability in versions before 5.2.2. The vulnerability arises because the extractall function does not properly sanitize or validate filenames in ZIP or TAR archives, allowing an attacker to craft archives that write files outside the target directory. This can lead to arbitrary file overwrite and potentially remote code execution. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). Version 5.2.2 of gdown contains a fix addressing this issue.

Exploitation of this vulnerability can result in arbitrary file overwrite outside the intended extraction directory, which may lead to remote code execution if an attacker places malicious executable files. This compromises the integrity of the system where gdown is used. There are no known exploits in the wild at this time.

Upgrade gdown to version 5.2.2 or later, where the path traversal vulnerability in the extractall functionality has been fixed. Patch status is confirmed by the version update. No additional vendor advisory is provided, so check the official gdown repository or release notes for the latest remediation details.