CVE-2019-16511

5.5 mediumEPSS 1.5%

Medium (5.5) in firegiant wix toolset. EPSS 1.5% chance of exploitation in the next 30 days.

An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file (even with a ../ sequence) is concatenated with the destination path.

Severity

CVSS 3.1

5.5 medium

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS: 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2019-09-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

firegiant:wix_toolset

References

https://github.com/GitHubAssessments/CVE_Assessments_09_2019
https://github.com/wixtoolset/issues/issues/6075
https://wixtoolset.org/development/wips/6075-dtf-zip-slip/
https://www.firegiant.com/blog/2019/9/18/wix-v3.11.2-released/
https://github.com/GitHubAssessments/CVE_Assessments_09_2019

Check your stack JSON