Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Migration Toolkit for Runtimes 1.1.1 ZIP artifactsSecurity Fix(es): htmlUnit: Stack overflow crash causes Denial of Service (DoS) (CVE-2023-2798) zip4j: does not always check the MAC when decrypting a ZIP archive (CVE-2023-22899) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.