CVE-2022-48285: JSZip contains Path Traversal via loadAsync – CVSS 7.3 · Watchpost

← All vulnerabilities

JSZip contains Path Traversal via loadAsync

높음 7.3CVE-2022-48285 · GHSA-36fh-84j7-cv5h · Published 29/01/2023 · updated 17/06/2026

요약

CVE-2022-48285은(는) jszip (jszip project), jszip에 영향을 주는 높음 (CVSS 7.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.4%, 전체 취약점의 72.8%보다 높음.
조치: 3.8.0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
jszip jszip_project	`< 3.8.0`	`3.8.0`
jszip npm	`< 3.8.0`	`3.8.0`

Description

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.

NVD description

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.

References

nvd.nist.gov/vuln/detail/CVE-2022-48285 · ADVISORY
Stuk/jszip commit 2edab36 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/244499 · WEB
Stuk/jszip · PACKAGE
Stuk/jszip · WEB
security.netapp.com/advisory/ntap-20240621-0005 · WEB
mend.io/vulnerability-database/WS-2023-0004 · WEB
security.netapp.com/advisory/ntap-20240621-0005

jszip의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free