Directory Traversal in cross-zip Package by Feross
CVE-2025-11569
8.7HIGH
What is CVE-2025-11569?
The cross-zip package, developed by Feross, is susceptible to directory traversal due to improper handling of the zipSync() and unzipSync() functions. By exploiting this vulnerability, an attacker can manipulate the package to access sensitive system files. The issue arises when arguments such as __dirname are processed inappropriately, allowing malicious actors to execute selective zip and unzip operations that breach directory boundaries. This poses significant risks, especially in environments where sensitive information is stored.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
cross-zip 0
References
CVSS V4
Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Miguel Coimbra