CVE-2022-36943

HIGH

SSZipArchive < 2.5.3 - Arbitrary File Write via Symlink Path Traversal

Title source: llm

Description

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc

Scores

CVSS v3 8.1

EPSS 0.0080

EPSS Percentile 51.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

CWE

CWE-22 CWE-59

Status published

Products (1)

ziparchive_project/ziparchive < 2.5.3

Published Jan 03, 2023

Tracked Since Feb 18, 2026