CVE-2019-16511

MEDIUM 5.5CVE-2019-16511 · Published 19/09/2019 · updated 17/06/2026

In short

CVE-2019-16511 is a MEDIUM (CVSS 5.5) vulnerability affecting wix toolset (firegiant).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.9% of all vulnerabilities.
Fix: update to 3.11.2 or later.

Package	Affected versions	Patched versions
wix toolset firegiant	`< 3.11.2`	`3.11.2`

Description

An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file (even with a ../ sequence) is concatenated with the destination path.

References

GitHubAssessments/CVE_Assessments_09_2019
wixtoolset/issues · Patch
wixtoolset.org/development/wips/6075-dtf-zip-slip · Third Party Advisory
firegiant.com/blog/2019/9/18/wix-v3.11.2-released · Patch

More vulnerabilities in wix toolset

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free