CVE-2022-36943 — ZipArchive / SSZipArchive

Description (CNA)

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

Affected (CNA)

Vendor / product	Versions
ZipArchive / SSZipArchive	affected unspecified through 2.5.3

CWE

CWE-22

References

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc

ADP enrichment

CVE

No English description supplied.

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc

CISA-ADP

No English description supplied.

No references supplied.