CVE-2023-5938: Path traversal via 'zip slip' in Arc before v1.6.0
Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks.
An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have arbitrary files extracted to arbitrary filesystem locations. Leveraging this issue, an attacker may be able to overwrite arbitrary files on the target filesystem and cause critical impacts on the system (e.g., arbitrary command execution on the victim’s machine).
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5938?
CVE-2023-5938 is considered a critical vulnerability due to its potential for path traversal attacks through easily manipulated zip files.
How do I fix CVE-2023-5938?
To fix CVE-2023-5938, update the Arc software to version 1.6.1 or later, which addresses the vulnerability.
What types of attacks can exploit CVE-2023-5938?
CVE-2023-5938 can be exploited through 'zip slip' attacks that allow attackers to manipulate file paths in archives.
Which versions of the Arc software are affected by CVE-2023-5938?
CVE-2023-5938 affects Arc versions up to, but not including, version 1.6.1.
Who requires access to exploit CVE-2023-5938?
An attacker exploiting CVE-2023-5938 would need administrator privilege to provide the tampered archives.