Arbitrary File Write via Archive Extraction (Zip Slip)

Overview org.webjars.npm:unzipper is a library for the Uzip cross-platform streaming AP.I Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the extraction path validation in lib/extract.js and lib/Open/directory.js, which check only that t...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview unzipper is a library for the Uzip cross-platform streaming AP.I Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the extraction path validation in lib/extract.js and lib/Open/directory.js, which check only that the resolved path...

Unzipper vulnerable to directory traversal

Overview Unzipper provided by R-Company contains an issue in processing file names, which may result in a directory traversal CWE-22 vulnerability. Ryohei Koike of Sakura Information Systems Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...