CVE-2023-5938
Severity CVSS v4.0:
Pending analysis
Type:
CWE-22
Path Traversal
Publication date:
15/05/2024
Last modified:
28/05/2024
Description
Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via &#39;zip slip&#39; attacks.<br />
<br />
<br />
<br />
An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have arbitrary files extracted to arbitrary filesystem locations. Leveraging this issue, an attacker may be able to overwrite arbitrary files on the target filesystem and cause critical impacts on the system (e.g., arbitrary command execution on the victim’s machine).
Impact
Base Score 3.x
8.00
Severity 3.x
HIGH