{"id":"CVE-2018-1002201","aliases":["GHSA-qcf3-9vmh-xw4r","SNYK-JAVA-ORGZEROTURNAROUND-31681"],"url":"https://o3.security/vulnerability/CVE-2018-1002201","summary":"Improper Limitation of a Pathname to a Restricted Directory in zt-zip","details":"zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.","published":"2018-07-25T17:29:00.500Z","modified":"2026-07-09T00:22:00.868323Z","cvss":{"score":5.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":3,"affectedPackages":[{"ecosystem":"Maven","name":"org.zeroturnaround:zt-zip","fixedVersion":"1.13"}],"fix":{"url":"https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff","label":"zeroturnaround/zt-zip@759b72f"},"references":[{"type":"REPORT","url":"https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt"},{"type":"FIX","url":"https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff"},{"type":"FIX","url":"https://snyk.io/research/zip-slip-vulnerability"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681"},{"type":"EVIDENCE","url":"https://github.com/snyk/zip-slip-vulnerability"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T00:22:00.868323Z"}}