CVE-2022-36943

8.1 highEPSS 0.9%

High (8.1) in ziparchive project ziparchive. EPSS 0.9% chance of exploitation in the next 30 days.

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

Severity

CVSS 3.1

8.1 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS: 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-11-01)
CWEs: CWE-59, CWE-22
Published: 2023-01-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ziparchive_project:ziparchive

References

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc
https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc

Check your stack JSON