CVE-2022-36943

HIGH

8.1

Description

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

CVE Details

CVSS v3.1 Score8.1

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published1/3/2023

Last Modified1/28/2026

Sourcenvd

Honeypot Sightings0

Affected Products

ziparchive_project:ziparchive

Weaknesses (CWE)

CWE-22CWE-59

References

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc(cve-assign@fb.com)

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.