CyberRota Analysis
AI-GeneratedThe zip-lib package versions prior to 1.1.0 are susceptible to a Directory Traversal vulnerability due to inadequate path validation during file extraction, allowing attackers to bypass security measures. This can lead to unauthorized access to files outside the intended extraction directory. Organizations utilizing this package should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction.