{"id":"CVE-2018-1002209","details":"QuaZIP before 0.7.6 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.","modified":"2026-07-08T14:59:06.769810Z","published":"2018-07-25T17:29:02.283Z","references":[{"type":"ADVISORY","url":"https://github.com/snyk/zip-slip-vulnerability"},{"type":"ADVISORY","url":"https://github.com/stachenov/quazip/blob/0.7.6/NEWS.txt"},{"type":"ADVISORY","url":"https://snyk.io/research/zip-slip-vulnerability"},{"type":"FIX","url":"https://github.com/stachenov/quazip/commit/5d2fc16a1976e5bf78d2927b012f67a2ae047a98"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/stachenov/quazip","events":[{"introduced":"0"},{"fixed":"243a411091d7610be930a10ad225c5ae85415079"},{"fixed":"5d2fc16a1976e5bf78d2927b012f67a2ae047a98"}],"database_specific":{"cpe":"cpe:2.3:a:quazip_project:quazip:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"0.7.6"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["0.7.5","0.7.4"],"database_specific":{"vanir_signatures":[{"id":"CVE-2018-1002209-13338b17","signature_type":"Line","signature_version":"v1","source":"https://github.com/stachenov/quazip/commit/5d2fc16a1976e5bf78d2927b012f67a2ae047a98","target":{"file":"qztest/testjlcompress.cpp"},"deprecated":false,"digest":{"line_hashes":["84964277813786453156411166944239017136","59897822795453575447970311536300491678","306976697354534563421295546789655473125","335682323187728135243461504599500553478","152976444422131803573926974723964094947","73799363749511098164724380682367545767","5199962883936935214637400425697098444","153683394390425474534542507607209895332","156326942548743847085489057365476549702","147977500324481807428722503365978817871","55370485735271755551428634525445725220","131297334797943774484266724209053092715","79675462769164938573799224952225074651","31684057245133976800433242111554139941","190262990600750357696718075035660272994","212330602770991623463900733786892947643","71288939177005413155285182344556432331","244161016006634323882873870714274064526","257009830194572049010835760645789110401","21748362017839608824212572698353222776","320230813632367292764139879990597767951","267702786370664760027401400573633829084","87575832289270323765301719332422330542","93877977589678444488245305182860234557","297992689814009858746551275724640271283","273971235034206828052317207047613345660","71288939177005413155285182344556432331","244161016006634323882873870714274064526","257009830194572049010835760645789110401","21748362017839608824212572698353222776","320230813632367292764139879990597767951","267702786370664760027401400573633829084","87575832289270323765301719332422330542"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"151304024063569249164932340670981340713","length":414},"id":"CVE-2018-1002209-1a0d75d8","signature_type":"Function","signature_version":"v1","source":"https://github.com/stachenov/quazip/commit/5d2fc16a1976e5bf78d2927b012f67a2ae047a98","target":{"file":"qztest/testjlcompress.cpp","function":"TestJlCompress::extractDir_data"}},{"signature_version":"v1","source":"https://github.com/stachenov/quazip/commit/5d2fc16a1976e5bf78d2927b012f67a2ae047a98","target":{"file":"quazip/JlCompress.cpp","function":"JlCompress::extractDir"},"deprecated":false,"digest":{"function_hash":"231169186614628685644914734545396177008","length":583},"id":"CVE-2018-1002209-53eb81de","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["11103257041787783009072100717101844563","327175967503350174501014185862462445356","329278571730566616470825361418110010652","197178668388265780419153273824263615926","223370957857944527227943161647235919015","199850395651935671312889671924375665285","173499849326900857809745821282035421569","238335914204822262067363816587639538663"],"threshold":0.9},"id":"CVE-2018-1002209-b4afd939","signature_type":"Line","signature_version":"v1","source":"https://github.com/stachenov/quazip/commit/5d2fc16a1976e5bf78d2927b012f67a2ae047a98","target":{"file":"quazip/JlCompress.cpp"}},{"deprecated":false,"digest":{"function_hash":"217693521649384532664589834376889482998","length":1756},"id":"CVE-2018-1002209-fdf43869","signature_type":"Function","signature_version":"v1","source":"https://github.com/stachenov/quazip/commit/5d2fc16a1976e5bf78d2927b012f67a2ae047a98","target":{"file":"qztest/testjlcompress.cpp","function":"TestJlCompress::extractDir"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-1002209.json","vanir_signatures_modified":"2026-07-08T14:59:06Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"}]}