CVE-2018-1002209 - AskarLabs CVE Database

CVE-2018-1002209

Vendor Quazip

Product quazip

Weakness CWE-22 · Path traversal

Published July 25, 2018

Last update September 16, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Key dates

02Disclosure timeline

July 25, 2018 CVE published

September 16, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-1002209 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html

Related vulnerabilities

04Related CVE

CVE-2024-23652 BuildKit possible host system access from mount stub cleaner CVE-2025-34031 Moodle LMS Jmol Plugin Path Traversal CVE-2025-6445 ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability CVE-2024-52054 Application Creation Path Traversal in Wowza Streaming Engine CVE-2026-0964 Libssh: improper sanitation of paths received from scp servers