Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.
AnalysisAI
An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. Affected products include: Archive Project Archive.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.
An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing. Rate
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Symlink-based path traversal in the Perl module Archive::Tar before version 3.08 allows a malicious tar archive to write
Arbitrary file modification in the Perl Archive::Tar module before version 3.08 allows a malicious tar archive to create
Memory exhaustion in the Perl Archive::Tar module before version 3.10 lets remote attackers cause a denial of service by
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today