JSZip contains Path Traversal via loadAsync

HIGH 7.3CVE-2022-48285 · GHSA-36fh-84j7-cv5h · Published 29/01/2023 · updated 17/06/2026

In short

CVE-2022-48285 is a HIGH (CVSS 7.3) vulnerability affecting jszip (jszip project), jszip.
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.8% of all vulnerabilities.
Fix: update to 3.8.0 or later.

Package	Affected versions	Patched versions
jszip jszip_project	`< 3.8.0`	`3.8.0`
jszip npm	`< 3.8.0`	`3.8.0`

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.

NVD description

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.