CVE-2025-29213

A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file...

CVE-2025-29213

A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file...

E.D.D.I 路径遍历漏洞

E.D.D.I is a LABS.AI open source middleware for connecting and managing LLM API robots. A path traversal vulnerability exists in E.D.D.I versions prior to 5.5.0, which stems from a Zip Slip vulnerability that could lead to arbitrary file writes and remote code execution...

CVE-2025-29213

CVE-2025-29213 affects JeeWMS v3.7 in the service migrate module, specifically the MigrateForm.java component. The vulnerability is a zip-slip flaw that can lead to arbitrary code execution when processing crafted ZIP files. Documents consistently name the vulnerable path as \service\migrate\Migr...

PT-2025-16383 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JEEWMS version 3.7 Description: A zip slip vulnerability in the MigrateForm.java component of the service migrate module allows attackers to execute arbitrary code via a crafted Zip file. This issue can potentially be exploited to gain...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview github.com/mholt/archiver is a cross-platform, multi-format archive utility and Go library. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the Unarchive function. An attacker can overwrite sensitive files and potentially escala...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the Unarchive function. An attacker can overwrite sensitive files and potentially escalate privileges by supplying a malicious archive file containing symlinks, which is unarchived...

CVE-2025-3445

A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...

CVE-2025-3445

A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...

CVE-2025-3445

A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the...

CVE-2025-3445

CVE-2025-3445 (Zip Slip in mholt/archiver, Go) : A crafted ZIP can cause path traversal during archiver.Unarchive(zipFile, outputDir), permitting write/overwrite of files with the app’s privileges. This can lead to privilege escalation or code execution in affected setups. The advisory notes a TA...

PT-2025-16188 · Unknown · Mholt/Archiver

Name of the Vulnerable Software and Affected Versions: mholt/archiver versions affected versions not specified Description: A Path Traversal "Zip Slip" vulnerability has been identified in the mholt/archiver library in Go. This issue allows an attacker to use a crafted ZIP file containing path...

Directory Traversal

Overview zip-lib is a zip and unzip library for node Affected versions of this package are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended...

Directory Traversal

Overview aws-sam-cli is an AWS SAM CLI is a CLI tool for local development and testing of Serverless applications Affected versions of this package are vulnerable to Directory Traversal through the symlink handling process. After completing a build, the content of those symlinks is copied to the...

go.rgst.io/stencil/v2 vulnerable to Path Traversal

Impact The library used to extract archives github.com/jaredallard/archives was vulnerable to the "zip slip" vulnerability. This is used to extract native extension archives and repository source archives. A native extension or repository archive could be crafted in such a way where a remote code...

GHSA-P799-Q2PR-6MXJ go.rgst.io/stencil/v2 vulnerable to Path Traversal

Impact The library used to extract archives github.com/jaredallard/archives was vulnerable to the "zip slip" vulnerability. This is used to extract native extension archives and repository source archives. A native extension or repository archive could be crafted in such a way where a remote code...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip in the extract function in extractor.go, which doesn't sufficiently sanitize its input. An attacker can execute arbitrary commands or modify files with the permission of the user by...

Directory Traversal

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to Directory Traversal via the Staging Sync Server, which does not sufficiently protect librarySubFolderPath against traversal sequence...

Directory Traversal

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Directory Traversal in the LockManager.releaselocks function. An attacker can delete arbitrary files on the filesystem by passing an absolute path to the target file ...

Directory Traversal

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Directory Traversal via the LocalFileManager.cleanup function, by crafting a malicious glob-pattern that is not verified to be within the directory managed by...