CVSS 3.0
6.5 mediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NCVE-2018-1002202
Medium (6.5) in zip4j project zip4j. EPSS 13% chance of exploitation in the next 30 days. Fixed in net.lingala.zip4j:zip4j 1.3.3.
zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Severity
- EPSS
- 13% chance of exploitation in the next 30 days; higher than 96% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- zip4j_project:zip4j
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2rpm-4x8c-pvqg | Maven | net.lingala.zip4j:zip4j | <1.3.3 | 1.3.3 |