mat2 before 0.13.0 allows directory traversal during the ZIP archive cleaning process.

높음 7.5CVE-2022-35410 · GHSA-f33p-9287-h552 · PYSEC-2022-223 · Published 08/07/2022 · updated 17/06/2026

요약

CVE-2022-35410은(는) mat2, mat2 (0xacab)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 2.3%, 전체 취약점의 83.1%보다 높음.
조치: 0.13.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
mat2 PyPI	`< 0.13.0`	`0.13.0`
mat2 0xacab	`< 0.13.0`	`0.13.0`

Description

mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.

NVD description

mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.

References

nvd.nist.gov/vuln/detail/CVE-2022-35410 · ADVISORY
0xacab.org/jvoisin/mat2 · PACKAGE
0xacab.org/jvoisin/mat2/-/commit/beebca4bf1cd3b935824c966ce077e7bcf610385 · WEB
0xacab.org/jvoisin/mat2/-/issues/174 · WEB
dustri.org/b/mat2-0130.html · WEB
GitHub Advisory GHSA-f33p-9287-h552 · ADVISORY
pypa/advisory-database · WEB
debian.org/security/2022/dsa-5185 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free