Directory Traversal in cross-zip Package by Feross

CVE-2025-11569

What is CVE-2025-11569?

The cross-zip package, developed by Feross, is susceptible to directory traversal due to improper handling of the zipSync() and unzipSync() functions. By exploiting this vulnerability, an attacker can manipulate the package to access sensitive system files. The issue arises when arguments such as __dirname are processed inappropriately, allowing malicious actors to execute selective zip and unzip operations that breach directory boundaries. This poses significant risks, especially in environments where sensitive information is stored.

References