GitHub Advisoryadvisory · npm

GHSA-884w-698f-927f Arbitrary File Write via Archive Extraction in unzipper

MEDIUM Published 2018-07-27 Modified 2023-09-11 Official page ↗
Aliases
CVE-2018-1002203
Ecosystem
npm
Packages
unzipper
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2020-06-16

Affected packages

• npm unzipper: < 0.8.13 → fixed in 0.8.13

Description

Versions of `unzipper` before 0.8.13 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (`../../file.txt` for example). Recommendation Update to version 0.3.18 or later.

Related

Alias · CVE (1)

  • CVE-2018-1002203 unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References