CVE-2018-10860: Path Traversal
Last updated 25 August 2025
Other sources
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-10860?
CVE-2018-10860 is considered a medium severity vulnerability due to its potential for directory traversal attacks when extracting zip files.
How do I fix CVE-2018-10860?
To fix CVE-2018-10860, upgrade the Archive::Zip module to version 1.60 or higher.
What systems are affected by CVE-2018-10860?
CVE-2018-10860 affects systems running vulnerable versions of the Archive::Zip module, particularly on Debian and Ubuntu distributions.
Can CVE-2018-10860 lead to unauthorized file access?
Yes, CVE-2018-10860 can allow an attacker to perform unauthorized file access and write to arbitrary locations on the file system.
Is CVE-2018-10860 related to Archive::Zip module only?
Yes, CVE-2018-10860 specifically pertains to vulnerabilities in the Archive::Zip Perl module.