JSZip contains Path Traversal via loadAsync

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

1pux-to-csv (>=1.0.0, <=1.1.0), 20-exceljs (>=4.5.7, <=4.5.9) +872 more potentially affected by CVE-2022-48285 via jszip (>=3.0.0, <=3.7.1)

jszip NPM version =3.0.0, =1.0.0, =4.5.7, =0.2.48, =0.2.50, =0.2.46, =0.2.46, =0.2.46, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.5-20190507210024, =0.0.37, =0.0.36, =0.0.37, =0.24.0 and more Source cves: CVE-2022-48285 Source advisory: GHSA-36FH-84J7-CV5H...

CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

AZL-38236 CVE-2022-48285 affecting package mozjs for versions less than 102.15.1-1

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

AZL-57076 CVE-2022-48285 affecting package beust-jcommander 2.0-1

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

Directory traversal

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

UBUNTU-CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

CVE-2022-48285

CVE-2022-48285 affects JSZip: the loadAsync function in JSZip before 3.8.0 can be exploited to perform a directory traversal via crafted ZIP archives, enabling access to files outside the target directory. Remediation: upgrade to JSZip 3.8.0 or later, which fixes the issue.

CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

CVE-2022-48285: Improper Limitation of a Pathname to a Restricted Directory

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

1pux-to-csv (>=1.0.0, <=1.1.0), 1st-20200429 (1.1.0) +3573 more potentially affected by CVE-2022-48285 via jszip (>=0.2.1, <=3.7.1)

jszip NPM version =0.2.1, =1.0.0, =4.5.7, =1.0.0, =0.3.1, =0.2.48, =0.2.50, =0.2.46, =0.2.46, =0.2.46, =0.24.1-20230627140514 and more Source cves: CVE-2022-48285 Source advisory: MEND:CVE-2022-48285...

JSZip path traversal vulnerability

jszip is a JavaScript library for creating, reading and editing .zip files. A security vulnerability exists in jszip versions prior to 3.8.0, which stems from allowing directory traversal through a crafted ZIP archive...

CVE-2022-48285

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive...

Jszip Zip File Processing DoS

The vulnerability of the Jszip zip file processing library is related to incorrect handling of file names. Exploiting this vulnerability allows a remote attacker to cause service interruptions...

PT-2022-6761 · Jszip +1 · Jszip +1

Name of the Vulnerable Software and Affected Versions: JSZip versions prior to 3.8.0 Description: The issue is related to the loadAsync function in JSZip, which allows directory traversal via a crafted ZIP archive. This can be exploited by a remote attacker to write arbitrary files and execute...