Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
101 results · page 1 of 3
Oct 22, 2026Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to CVE-2026-115503 · Other software · NationalSecurityAgency · reported by VulnCheckMedium 6.8
Ghidra before 12.2 contains an improper handling of highly compressed data vulnerability in ExtensionUtils.unzipToInstallationFolder() that allows attackers to exhaust disk space. Attackers can persuade users to install a crafted zip bomb extension archive that expands without size limits, causing later writes by Ghidra and other applications to fail.
- Product
- ghidra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP eCVE-2026-115397 · Other software · NationalSecurityAgency · reported by VulnCheckMedium 6.8
Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder() that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesystem inodes, causing project writes and other processes to fail.
- Product
- ghidra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2026KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recCVE-2026-104081 · Other software · kalcaddle · reported by VulnCheckHigh 7.2
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.
- Product
- KodExplorer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 7, 2026A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)).CVE-2026-41958 · Other software · visidata · reported by talos-cna@cisco.comMedium 6.5
A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability.
- Product
- visidata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer CVE-2026-59311 · Other software · Spring · reported by security@vmware.comMedium 6.8
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
- Product
- Spring Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026The UnZipTransformer does not limit decompressed entry size or entry count when processing archives.CVE-2026-59274 · Other software · Spring · reported by security@vmware.comMedium 6.5
The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zip archive that can exhaust JVM heap memory, causing a denial-of-service outage. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12
- Product
- Spring Integration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0.CVE-2026-78638 · Other software · peerigon · reported by VulDBLow 1.9
A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- unzip-crx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a UnCVE-2026-13723 · Other software · Develar · reported by cret@cert.orgMedium 6.5
A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing: • a symlink entry named ss pointing to a target file, and • a regular file named ß containing attacker controlled data, will cause the second write to follow the symlink and overwrite the target file.
- Product
- app-builder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 27, 2026A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3.CVE-2026-17514 · Other software · ZJONSSON · reported by VulDBLow 1.9
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- node-unzipper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2026fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync().CVE-2026-45820 · Other software · 101arrowz · reported by 22e2d327-25fe-45d7-9f0c-dcd23b7108dfMedium 6.6
fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.
- Product
- fflate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.CVE-2026-48959 · Other software · PMQS · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eHigh 7.5
IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward. fastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration. Extracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap.
- Product
- IO::Uncompress::Unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commetacpan.org
May 27, 2026IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date.CVE-2025-15649 · Other software · PMQS · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.5
IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes the local-file-header last-modification date field and calls Time::Local::timelocal() without an eval guard. A header whose date field decodes to an out-of-range month, day, or hour causes timelocal() to die. The exception propagates out of IO::Uncompress::Unzip->new($file) where callers expect undef plus $UnzipError.
- Product
- IO::Uncompress::Unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution.CVE-2024-36057 · Other software · reported by MITRECritical 9.8
Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution. The line "qx/unzip $filename -d $dirname/;" in upload-cover-image.pl is vulnerable to command injection via shell metacharacters because input data can be controlled by an attacker and is directly included in a system command, i.e., an attack can occur via malicious filenames after uploading a .zip file and clicking Process Images.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2026pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory tCVE-2025-70952 · Other software · Pf4j Project · reported by MITREHigh 7.5
pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation.
- Product
- Pf4j
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Mar 11, 2026yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLasCVE-2026-31988 · Other software · thejoshwolfe · reported by VulnCheckMedium 6.9
yauzl (aka Yet Another Unzip Library) version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate() function. The while loop condition checks cursor < data.length + 4 instead of cursor + 4 <= data.length, allowing readUInt16LE() to read past the buffer boundary. A remote attacker can cause a denial of service (process crash via ERR_OUT_OF_RANGE exception) by sending a crafted zip file with a malformed NTFS extra field. This affects any Node.js application that processes zip file uploads and calls entry.getLastModDate() on parsed entries. Fixed in version 3.2.1.
- Product
- yauzl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 24, 2025A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff.CVE-2025-25214 · Other software · WWBN · reported by talos-cna@cisco.comHigh 8.8
A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of specially crafted HTTP request can lead to arbitrary code execution.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jun 11, 2025Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities.CVE-2022-4976 · Other software · ETJ · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities. The bundled library is affected by CVE-2014-8139, CVE-2014-8140 and CVE-2014-8141.
- Product
- Archive::Unzip::Burst
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2025Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.CVE-2025-49163 · Other software · Arris · reported by MITREMedium 6.7
Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file.
- Product
- VIP1113
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in suppoCVE-2025-23410 · Other software · GMOD · reported by ics-cert@hq.dhs.govCritical 9.3
When uploading organism or sequence data via the web interface, GMOD Apollo will unzip and inspect the files and will not check for path traversal in supported archive types.
- Product
- Apollo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 12, 2025In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access.CVE-2024-11343 · Other software · Progress Software · reported by security@progress.comHigh 8.3
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 (2025.1.205), unzipping an archive can lead to arbitrary file system access.
- Product
- Telerik Document Processing Libraries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 29, 2025A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locationsCVE-2025-0851 · Other software · AWS · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Critical 9.3
A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
- Product
- DeepJavaLibrary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Dec 2, 2024unzip-bot is a Telegram bot to extract various types of archives.CVE-2024-53992 · Other software · EDM115 · reported by GitHubHigh 8.8
unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This vulnerability is fixed in 7.0.3a.
- Product
- unzip-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 22, 2024Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability.CVE-2024-5581 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comHigh 7.2
Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-23453.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalltena.comzerodayinitiative.com
Nov 22, 2024Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability.CVE-2023-51645 · Other software · Allegra · reported by zdi-disclosures@trendmicro.comMedium 4.7
Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the unzipFile method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of LOCAL SERVICE. Was ZDI-CAN-22513.
- Product
- Allegra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtrackplus.comzerodayinitiative.com
Oct 1, 2024Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function.CVE-2024-46084 · Other software · scriptcase · reported by MITREHigh 8
Scriptcase 9.10.023 and before is vulnerable to Remote Code Execution (RCE) via the nm_unzip function.
- Product
- scriptcase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 10, 2024Upunzipper: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-35744 · WordPress plugins & themes · reported by PatchstackHigh 8.6
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ravidhu Dissanayake Upunzipper allows Path Traversal, File Manipulation.This issue affects Upunzipper: from n/a through 1.0.0.
- Product
- Upunzipper
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update Upunzipper to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 3, 2024As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that exCVE-2024-0765 · Other software · mintplex-labs · reported by security@huntr.devMedium 6.5
As a default user on a multi-user instance of AnythingLLM, you could execute a call to the `/export-data` endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit access to the system, but they can do this at any role. Additionally, post-download, the data is deleted so no evidence would exist that the exfiltration occured.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.CVE-2024-25978 · Other software · Moodle · reported by patrick@puiterwijk.orgHigh 7.5
Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.moodle.orgbugzilla.redhat.com
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36561 · Other software · github.com/yi-ge/unzip · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/yi-ge/unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36560 · Other software · github.com/artdarek/go-unzip · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/artdarek/go-unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create orCVE-2022-42125 · Other software · Liferay · reported by MITREHigh 7.5
Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.
- Product
- Digital Experience Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissues.liferay.comportal.liferay.dev
Aug 24, 2022A flaw was found in unzip.CVE-2021-4217 · Other software · Unzip Project · reported by Red HatLow 3.3
A flaw was found in unzip. The vulnerability occurs due to improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
- Product
- Unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.launchpad.net
Aug 22, 2022A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.CVE-2022-30547 · Other software · WWBN · reported by talos-cna@cisco.comCritical 9.9
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtalosintelligence.com
Apr 11, 2022Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to access the file of Galaxy CVE-2022-28544 · Computers, phones & browsers · Samsung Mobile · reported by mobile.security@samsung.comMedium 6.2
Path traversal vulnerability in unzip method of InstallAgentCommonHelper in Galaxy store prior to version 4.5.40.5 allows attacker to access the file of Galaxy store.
- Product
- Galaxy Store
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.samsungmobile.comsecurity.samsungmobile.com
Mar 28, 2022An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladedCVE-2021-43099 · Other software · Diyhi · reported by MITREMedium 4.9
An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).
- Product
- BBS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2022MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.CVE-2021-46037 · Other software · Mingsoft · reported by MITREHigh 8.1
MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
- Product
- Mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlycshub.github.iolycshub.github.io
Feb 9, 2022A flaw was found in Unzip.CVE-2022-0530 · Other software · Unzip Project · reported by Red HatMedium 5.5
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
- Product
- Unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgseclists.org
Feb 9, 2022A flaw was found in Unzip.CVE-2022-0529 · Other software · Unzip Project · reported by Red HatMedium 5.5
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
- Product
- Unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Nov 11, 2021OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repositCVE-2021-3912 · Other software · Cloudflare · reported by cna@cloudflare.comMedium 4.2
OctoRPKI tries to load the entire contents of a repository in memory, and in the case of a GZIP bomb, unzip it in memory, making it possible to create a repository that makes OctoRPKI run out of memory (and thus crash).
- Product
- octorpki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2021FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.CVE-2021-21689 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comCritical 9.1
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
- Product
- Jenkins
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 14, 2021A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary direcCVE-2021-33211 · Other software · Element-it · reported by MITREMedium 6.5
A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives.
- Product
- Http Commander
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 18, 2021SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution oCVE-2021-31272 · Other software · Serenityos · reported by MITRECritical 9.8
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.
- Product
- Serenityos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2021A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed pCVE-2021-24035 · Other software · Facebook · reported by cve-assign@fb.comCritical 9.1
A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.
- Product
- WhatsApp Business for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhatsapp.comwhatsapp.com
Mar 19, 2021decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, viCVE-2021-28831 · Other software · Busybox · reported by MITREHigh 7.5
decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huft_build result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data.
- Product
- Busybox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.busybox.netlists.debian.org
Feb 15, 2021A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backupCVE-2020-28337 · Other software · Microweber · reported by MITREHigh 7.2
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
- Product
- Microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 9, 2021A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malforCVE-2019-17582 · Other software · Libzip · reported by MITRECritical 9.8
A use-after-free in the _zip_dirent_read function of zip_dirent.c in libzip 1.2.0 allows attackers to have an unspecified impact by attempting to unzip a malformed ZIP archive. NOTE: the discoverer states "This use-after-free is triggered prior to the double free reported in CVE-2017-12858."
- Product
- Libzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2020A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could leaCVE-2020-25630 · Other software · Moodle · reported by Red HatHigh 7.5
A vulnerability was found in Moodle where the decompressed size of zip files was not checked against available user quota before unzipping them, which could lead to a denial of service risk. This affects versions 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
- Product
- Moodle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2020An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resultedCVE-2020-1903 · Other software · Facebook · reported by cve-assign@fb.comMedium 5.5
An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an out-of-memory denial of service. This issue would have required the receiver to explicitly open the attachment if it was received from a number not in the receiver's WhatsApp contacts.
- Product
- WhatsApp for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwhatsapp.comwhatsapp.com
Mar 9, 2020A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracteCVE-2020-1737 · Other software · Red Hat · reported by Red HatHigh 7.5
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
- Product
- Ansible
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Jan 31, 2020Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip fiCVE-2014-8141 · Other software · Info-ZIP · reported by Red HatHigh 7.8
Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.
- Product
- UnZip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordocert.orgsecuritytracker.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.