GHSA-vgwr-773q-7j3c

Suggest an improvement
Source
https://github.com/advisories/GHSA-vgwr-773q-7j3c
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-vgwr-773q-7j3c/GHSA-vgwr-773q-7j3c.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-vgwr-773q-7j3c
Aliases
Published
2021-03-24T17:58:13Z
Modified
2024-12-02T05:44:11.412373Z
Summary
Path Traversal within joomla/archive zip class
Details

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-24T17:57:48Z"
}
References

Affected packages

Packagist / joomla/archive

Package

Name
joomla/archive
Purl
pkg:composer/joomla/archive

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.10

Affected versions

1.*

1.0-alpha
1.0-beta
1.0-beta2
1.0-beta3
1.0
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.1.9