CVE-2018-1002202: Path Traversal
Published Jul 25, 2018
·Updated
zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Affected Software
1 affected component
Zip4j Project Zip4j<1.3.3
Remediation
Patch Available
Event History
Jul 25, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-1002202?
CVE-2018-1002202 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2018-1002202?
To fix CVE-2018-1002202, upgrade Zip4j to version 1.3.3 or later.
3
What are the implications of CVE-2018-1002202?
CVE-2018-1002202 allows attackers to exploit directory traversal to write to arbitrary files during zip extraction.
4
Which versions of Zip4j are affected by CVE-2018-1002202?
Versions of Zip4j prior to 1.3.3 are affected by CVE-2018-1002202.
5
Is CVE-2018-1002202 a common vulnerability?
CVE-2018-1002202 is a known vulnerability associated with zip file extraction, particularly in applications that handle untrusted zip data.