CVE-2018-1002200 — Path Traversal in Plexus-archiver

CWE-22 — Path Traversal13 documents8 sources
Severity
5.5MEDIUMNVD
EPSS
3.1%
top 13.26%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Codehaus Plexus-archiverCodehaus-plexus Plexus-archiverGithub.com Zarf-dev Zarf SRC PKG Archive+5 more
Timeline
PublishedJul 25
Latest updateMar 6

Description

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages7 packages

▶debiandebian/plexus-archiver< plexus-archiver 3.6.0-1 (bookworm)
▶CVEListV5codehaus/plexus-archiverunspecified — 3.6.0

Also affects: Debian Linux 8.0, 9.0, Enterprise Linux 7.5

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
Zarf's symlink targets in archives are not validated against destination directory↗2026-03-06
▶
GHSA
Zarf's symlink targets in archives are not validated against destination directory↗2026-03-06
▶
GHSA
Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver↗2022-05-13
▶
OSV
Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver↗2022-05-13
▶
OSV
CVE-2018-1002200: plexus-archiver before 3↗2018-07-25
▶

📋Vendor Advisories

3
Ubuntu
Plexus Archiver vulnerability↗2021-03-15
▶
Red Hat
plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file↗2018-06-05
▶
Debian
CVE-2018-1002200: plexus-archiver - plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing atta...↗2018
▶

📄Research Papers

1
arXiv
How well does LLM generate security tests?↗2023-10-03
▶

💬Community

3
Bugzilla
CVE-2018-1002200 plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file [fedora-28]↗2018-06-06
▶
Bugzilla
CVE-2018-1002200 plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file [fedora-27]↗2018-06-06
▶
Bugzilla
CVE-2018-1002200 plexus-archiver: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file↗2018-05-30
▶
CVE-2018-1002200 — Path Traversal in Plexus-archiver | cvebase