logo

Database

Lack of data validation - Path Traversal In jszip

Description

JSZip contains Path Traversal via loadAsync loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-482852. NVD-2022-482853. OSV-DEBIAN-2022-482854. OSV-2022-482855. GCVE-2022-482856. SECURITY-TRACKER-CVE-2022-48285

References

1. https://github.com/Stuk/jszip/commit/2edab366119c9ee948357c02f1206c28566cdf152. https://exchange.xforce.ibmcloud.com/vulnerabilities/2444993. https://github.com/Stuk/jszip/compare/v3.7.1...v3.8.04. https://security.netapp.com/advisory/ntap-20240621-00055. https://www.mend.io/vulnerability-database/WS-2023-0004

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.