Vulnerability GHSA-qcf3-9vmh-xw4r
Medium Risk
MEDIUM RISK
CVSS Score: 5.5
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 years ago
May 13, 2022 at 01:30 AM UTC
Improper Limitation of a Pathname to a Restricted Directory in zt-zip
1.4 and 1.5 and 1.6 and 1.7 and 1.8 and 1.9 and 1.10 and 1.11 and 1.12
1.4 and 1.5 and 1.6 and 1.7 and 1.8 and 1.9 and 1.10 and 1.11 and 1.12
Summary
Improper Limitation of a Pathname to a Restricted Directory in zt-zip
Details
zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 hours ago
zt-zip: ZipUtil.unpack can change file permissions of output directory
1.4 and 1.5 and 1.6 and 1.7 and 1.8 and 1.9 and 1.10 and 1.11 and 1.12 and 1.13 and 1.14 and 1.15 and 1.16 and 1.17 and 1.18.0 GHSA-v2g6-7r9j-v6px
1.4 and 1.5 and 1.6 and 1.7 and 1.8 and 1.9 and 1.10 and 1.11 and 1.12 and 1.13 and 1.14 and 1.15 and 1.16 and 1.17 and 1.18.0 GHSA-v2g6-7r9j-v6px
High Risk
6 hours ago
zt-zip: Path traversal in fluent API unpack
1.4 and 1.5 and 1.6 and 1.7 and 1.8 and 1.9 and 1.10 and 1.11 and 1.12 and 1.13 and 1.14 and 1.15 and 1.16 and 1.17 GHSA-52c6-99qm-3hqr
1.4 and 1.5 and 1.6 and 1.7 and 1.8 and 1.9 and 1.10 and 1.11 and 1.12 and 1.13 and 1.14 and 1.15 and 1.16 and 1.17 GHSA-52c6-99qm-3hqr
Impacted packages
Timeline
Published
4 years ago
May 13, 2022 at 01:30 AM UTC
Fixed (1.13)
Unknown
Unknown
Last Modified
2 months ago
September 10, 2026 at 03:49 AM UTC