Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2023-39138: ZIPFoundation 0.9.16 allows malicious zip files to extract files outside intended path
CVE-2023-39138 · published 3 years ago
Summary
An attacker can create a zip file that tricks the software into extracting files from outside the intended directory, potentially allowing unauthorized access or actions. This affects systems using ZIPFoundation version 0.9.16. Update to the latest version to fix this vulnerability.
What to do
- Update github.com weichsel to version 0.9.18.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| swift | github.com | weichsel |
<= 0.9.17 Fix: upgrade to 0.9.18
|
| – | peakstep | zipfoundation |
0.9.16 cpe:2.3:a:peakstep:zipfoundation:0.9.16:*:*:*:*:*:*:* |
Original advisory text
An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.
An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.
References
- https://github.com/weichsel/ZIPFoundation/releases/tag/0.9.18
- https://github.com/advisories/GHSA-c2cc-3569-6jh2
- https://nvd.nist.gov/vuln/detail/CVE-2023-39138 Vendor Advisory
- https://ostorlab.co/vulndb/advisory/OVE-2023-4 Vendor Advisory
- https://ostorlab.co/vulndb/advisory/OVE-2023-6 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39138... Vendor Advisory
- https://github.com/weichsel/ZIPFoundation/issues/282 Third Party Advisory
- https://blog.ostorlab.co/zip-packages-exploitation.html Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-22Path Traversal
Timeline
Published30 Aug 2023
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta