Executive brief
w-zip is a Node.js library for creating and extracting ZIP archives. A path traversal vulnerability in versions before 1.0.12 allows an attacker to extract files outside the intended directory, potentially overwriting arbitrary files on the system or exposing sensitive data during archive extraction.
Technical details
The vulnerability is a classic path traversal (CWE-22) flaw in w-zip's archive extraction logic. When extracting ZIP files, the library fails to properly sanitize or validate file paths within the archive, allowing attackers to use directory traversal sequences (e.g., "../") to write files to arbitrary locations on the filesystem. The vulnerability requires a maliciously crafted ZIP archive to be processed by an application using w-zip; no authentication or special privileges are needed. An attacker can achieve arbitrary file write/overwrite or information disclosure depending on filesystem permissions. The fix was released in version 1.0.12 (commit d7039d034).
Affected products
- w-zip w-zip before 1.0.12
Timeline
- 2022-02-02: disclosed: GHSA advisory published
- 2021-10-22: patched: Fix committed to repository (version 1.0.12)
- 2022-02-01: other: CVE-2022-0401 published by NVD