Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

diffplug goomph can write files anywhere via crafted zip

CVE-2022-26049 · published 4 years ago
Summary

The goomph tool from Diffplug can be tricked by a specially crafted zip file to place files outside its intended folder. This could let an attacker replace important system files and potentially run code on your computers. To protect yourself, only use trusted zip files for goomph and update to a version newer than 3.37.2 as soon as possible.

What to do
  • Update diffplug com.diffplug.gradle:goomph to version 3.37.2.
  • Update diffplug goomph to version 3.37.2 or later.
Affected software
Ecosystem VendorProductAffected versions
maven diffplug com.diffplug.gradle:goomph < 3.37.2
Fix: upgrade to 3.37.2
– diffplug goomph < 3.37.2
cpe:2.3:a:diffplug:goomph:*:*:*:*:*:*:*:*
Original advisory text
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability. **Note:** This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
5.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published11 Sep 2022
Updated29 Oct 2026
First seen6 Mar 2026
Sources
GHSA-p2f7-9cv7-jjf6 · GHSA
CVE-2022-26049 · NVD
CVE-2022-26049 · OSV
Track software like this
Free during beta