Executive brief
unzipper is a Node.js library for extracting ZIP archives. Versions before 0.8.13 are vulnerable to arbitrary file write when extracting specially crafted ZIP files containing path traversal sequences (e.g., ../../file.txt). An attacker can craft a malicious ZIP archive that, when extracted, writes files outside the intended extraction directory, potentially overwriting critical system or application files.
Technical details
The vulnerability is a path traversal flaw (CWE-22) in the archive extraction logic. When processing ZIP entries, unzipper fails to properly validate or sanitize filenames before concatenating them with the target extraction directory. An attacker can supply specially crafted ZIP archives with filenames containing relative path traversal sequences (../) that bypass directory boundaries. No authentication or special network conditions are required; the vulnerability is triggered simply by calling the extraction function with a malicious archive. An attacker can write arbitrary files to any location writable by the process running unzipper. The vulnerability was fixed in version 0.8.13 (released April 16, 2018).
Affected products
- unzipper unzipper before 0.8.13
Timeline
- 2018-07-27: disclosed: GHSA published
- 2018-04-16: patched: Fixed in version 0.8.13