Arbitrary File Write via Archive Extraction in unzipper

MEDIUM 5.5CVE-2018-1002203 · GHSA-884w-698f-927f · Published 25/07/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
unzipper unzipper_project	`< 0.8.13`	`0.8.13`
unzipper npm	`< 0.8.13`	`0.8.13`

Description

Versions of unzipper before 0.8.13 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (../../file.txt for example).

Recommendation

Update to version 0.3.18 or later.

NVD description

unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

References

nvd.nist.gov/vuln/detail/CVE-2018-1002203 · ADVISORY
ZJONSSON/node-unzipper#59 · WEB
ZJONSSON/node-unzipper commit 2220ddd · WEB
hackerone.com/reports/362119 · WEB
GitHub Advisory GHSA-884w-698f-927f · ADVISORY
snyk/zip-slip-vulnerability · WEB
snyk.io/research/zip-slip-vulnerability · WEB
snyk.io/vuln/npm:unzipper:20180415 · WEB
npmjs.com/advisories/680 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free