What is CVE-2022-36943?

CVE-2022-36943 is a high-severity vulnerability in Ziparchive Ssziparchive, classified under Path Traversal. CVSS score: 8.1/10. Published 2023-01-03.

How severe is CVE-2022-36943?

High severity. CVSS v3 base score is 8.1 out of 10.

Path Traversal in Ziparchive Ssziparchive

CVE-2022-36943

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.008 (53.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H.

Affected products

Ziparchive Ssziparchive — versions unspecified
Ziparchive_project Ziparchive

Weakness classification (CWE)

References

cve-assign@fb.com (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2022-36943?: CVE-2022-36943 is a high-severity vulnerability in Ziparchive Ssziparchive, classified under Path Traversal. CVSS score: 8.1/10. Published 2023-01-03.
How severe is CVE-2022-36943?: High severity. CVSS v3 base score is 8.1 out of 10.