description: SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.
problem types: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-61: UNIX Symbolic Link (Symlink) Following
affected:
{
vendor: ZipArchive
product: SSZipArchive
versions:
version: unspecified, lessThanOrEqual: 2.5.3, status: affected, versionType: custom
}