MEDIUM5.5
GHSA-qcf3-9vmh-xw4r
Improper Limitation of a Pathname to a Restricted Directory in zt-zip
Quick fix
GHSA-qcf3-9vmh-xw4r — org.zeroturnaround:zt-zip: upgrade to the fixed version with the command below.
# pom.xml: bump <version>1.13</version> for org.zeroturnaround:zt-zipDetails
zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven/org.zeroturnaround:zt-zip
Introduced in:
0Fixed in: 1.13Fix
# pom.xml: bump <version>1.13</version> for org.zeroturnaround:zt-zipReferences
- https://nvd.nist.gov/vuln/detail/CVE-2018-1002201[ADVISORY]
- https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff[WEB]
- https://github.com/snyk/zip-slip-vulnerability[WEB]
- https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt[WEB]
- https://snyk.io/research/zip-slip-vulnerability[WEB]
- https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681[WEB]