Directory Traversal Vulnerability in zt-zip by ZeroTurnaround
CVE-2018-1002201

5.5MEDIUM

Key Information:

Vendor

Zeroturnaround

Status
Zt-zip
Vendor
CVE Published:
3 October 2022

What is CVE-2018-1002201?

The zt-zip library prior to version 1.13 is susceptible to a directory traversal vulnerability, which can be exploited by attackers through manipulated Zip archive entries. This flaw may allow unauthorized users to write arbitrary files on the filesystem by utilizing the '../' (dot dot slash) notation. Such manipulation can lead to unwanted file overwrites or potentially execute malicious code, posing significant security risks to applications dependent on this library.

Affected Version(s)

zt-zip < 1.13

References

https://snyk.io/research/zip-slip-vulnerability
x_refsource_MISC
https://github.com/snyk/zip-slip-vulnerability
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681
x_refsource_MISC

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.