{"id":"CVE-2021-23520","details":"The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo() on a ZipFile object.","aliases":["SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388607"],"modified":"2026-07-09T11:24:21.369184Z","published":"2022-01-31T11:15:07.820Z","references":[{"type":"FIX","url":"https://github.com/juce-framework/JUCE/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f"},{"type":"FIX","url":"https://snyk.io/vuln/SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388607"},{"type":"EVIDENCE","url":"https://snyk.io/research/zip-slip-vulnerability"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/juce-framework/juce","events":[{"introduced":"0"},{"fixed":"0abbba3b18c3263137eeaeaa11c917a3425ce585"},{"fixed":"2e874e80cba0152201aff6a4d0dc407997d10a7f"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:juce:juce:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"6.1.5"}]}}],"versions":["6.1.4","6.1.3","6.1.2","6.1.1","6.1.0","6.0.8","6.0.7","6.0.6","6.0.5","6.0.4","6.0.3","6.0.1","6.0.0","5.4.7","5.4.6","5.4.5","5.4.4","5.4.3","5.4.2","5.4.1","5.4.0","5.3.2","5.3.1","5.3.0","5.2.1","5.2.0","5.1.2","4.2.3","4.2.2","4.2.1","4.2.0","4.1.0","4.0.3","4.0.2","4.0.1","3.2.0","3.1.1","3.1.0","3.0.8","3.0.7","3.0.6","3.0.5","3.0.4","3.0.3","3.0.2","3.0.1","3.0.0","2.1.8","2.1.7","2.1.6","2.1.5","2.1.4","2.1.3","2.1.2","2.1.1","2.0.41","2.0.40","2.0.39","2.0.38","2.0.37","2.0.36","2.0.35","2.0.34","2.0.33","2.0.32","2.0.31","2.0.0","1.53","1.52","1.51"],"database_specific":{"vanir_signatures":[{"source":"https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f","target":{"file":"modules/juce_core/zip/juce_ZipFile.cpp","function":"ZipFile::uncompressEntry"},"deprecated":false,"digest":{"function_hash":"237126485219913127008369546197861784848","length":1638},"id":"CVE-2021-23520-070bd10a","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2021-23520-1095d741","signature_type":"Line","signature_version":"v1","source":"https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f","target":{"file":"modules/juce_core/zip/juce_ZipFile.cpp"},"deprecated":false,"digest":{"line_hashes":["5665146828299311367131662985033393450","25705000018203975215230337355470258086","73461143352547144272351347185771427613","115105954260795451183459975315968406532","217244814178410470630742754195289869085","49084122028900548364993653296666858656","325991889492344124971183810307317007165","158767576336443612894225993343742284546","22882037744203086060580223086712743160","160593107989657383839657597257657288969","213451794356186389434614993281912298275","275721802318761377509861022008396111938","130653500459608639864472418804361048119","273332470345476517697735639630909816461","260462639253294651763368097174421627806","6020749457238924465845084673732165903","153320649057292567536622638828076027496","98871360293217199458224139798961620166","272885099627383471393744008177406840849","291575883478327668516045068826351348135","154979891626412947699061347020712952638","243963904254869942640995047314810898673","212840248489521459102842670956752041279","240427392179117427293706750928373018906","230474873361751680400794394115815013594","276369141589697939840954213595942450097","219947248126034986284379597760536714776","108809999214475554462129177081981798315","131708057395091255140995409953012566600","329777542193465666182838795792419497232","201901353281578892610176125317185222332","230657091421927173177949777420568947926","91325379333541385178968899147732598831","292963932828446528557640935761250622341","13828876792834701556718117794312153713"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f","target":{"file":"modules/juce_core/files/juce_TemporaryFile.cpp","function":"TemporaryFile::deleteTemporaryFile"},"deprecated":false,"digest":{"function_hash":"330644850256258962130216906016415763780","length":190},"id":"CVE-2021-23520-15d35dc1","signature_type":"Function"},{"digest":{"line_hashes":["252897070295914309755168594136393890767","330559751373960295323334258514495532823","18584094889909008286008261321626697420","94101849635669944803066779025124826108"],"threshold":0.9},"id":"CVE-2021-23520-27aa51cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f","target":{"file":"modules/juce_core/files/juce_TemporaryFile.cpp"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["313450786087896710849658816888521303545","158873883966962821624702911924557038862","198250517587726303670391863374999802557"],"threshold":0.9},"id":"CVE-2021-23520-583241be","signature_type":"Line","signature_version":"v1","source":"https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f","target":{"file":"modules/juce_core/zip/juce_ZipFile.h"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23520.json","vanir_signatures_modified":"2026-07-09T11:24:21Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}