CVE-2025-3485

CVE-2025-3485 describes a directory traversal in Allegra’s extractFileFromZip that fails to validate a user-supplied path before file operations, enabling remote code execution in the current process with network access. Authentication is required to exploit. Root cause: improper path validation ...