zip4j project vulnerabilities

Products

• zip4j 3

Latest zip4j project CVEs

Newest publication first

1. CVE-2023-22899 Zip4j Origin Validation Error

   Published 2023-01-10

   Medium·CVSS 5.9 EPSS 0.67%

   Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

2. CVE-2022-24615 Uncaught Exception in zip4j

   Published 2022-02-24

   Medium·CVSS 5.5 EPSS 0.71%

   zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.

3. CVE-2018-1002202 Improper Limitation of a Pathname to a Restricted Directory in Zip4j

   Published 2018-07-25

   Medium·CVSS 6.5 EPSS 12.6%

   zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.