Arc Vulnerable to Path Traversal Attacks via 'Zip Slip'

CVE-2023-5938

Summary

A security vulnerability exists in the Arc product from Nozomi Networks, where multiple functions fail to appropriately validate filenames within archives. This oversight exposes the application to path traversal attacks through maliciously crafted zip files. An administrator with the ability to supply altered archives may inadvertently allow an attacker to extract files to arbitrary locations on the filesystem. The potential consequences include overwriting critical system files, leading to unauthorized command execution or other severe impacts on the affected system.

References