CVE-2018-10860
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the...
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
- Record
CVE-2018-10860- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2018-2927
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
- Record
EUVD-2018-2927- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-46vh-339r-h4rg
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the...
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
- Record
GHSA-46vh-339r-h4rg- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
- Record
CVE-2018-10860- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
- Record
CVE-2018-10860- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-10860
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
- Record
DEBIAN-CVE-2018-10860- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2018-10860
perl-archive-zip is vulnerable to a directory traversal in Archive::Zip. It was found that the Archive::Zip module did not properly sanitize paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could use this flaw to write or overwrite arbitrary files in the context of the perl interpreter.
- Record
UBUNTU-CVE-2018-10860- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - Updated
- 2026-11-02
OSVMGASA-2018-0311 No score
Updated perl-Archive-Zip packages fix security vulnerability
It was discovered that the Archive::Zip module incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information (CVE-2018-10860).
- Record
MGASA-2018-0311- Updated
- 2026-11-02
OSVSUSE-SU-2018:2385-1 No score
Security update for perl-Archive-Zip
This update for perl-Archive-Zip fixes the following security issue:
- CVE-2018-10860: Prevent directory traversal caused by not properly sanitizing paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could have used this flaw to write or overwrite arbitrary files in the context of the perl interpreter (bsc#1099497)
- Record
SUSE-SU-2018:2385-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2386-1 No score
Security update for perl-Archive-Zip
This update for perl-Archive-Zip fixes the following security issue:
- CVE-2018-10860: Prevent directory traversal caused by not properly sanitizing paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could have used this flaw to write or overwrite arbitrary files in the context of the perl interpreter (bsc#1099497)
- Record
SUSE-SU-2018:2386-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2388-1 No score
Security update for perl-Archive-Zip
This update for perl-Archive-Zip fixes the following security issue:
- CVE-2018-10860: Prevent directory traversal caused by not properly sanitizing paths while extracting zip files. An attacker able to provide a specially crafted archive for processing could have used this flaw to write or overwrite arbitrary files in the context of the perl interpreter (bsc#1099497).
- Record
SUSE-SU-2018:2388-1- Updated
- 2026-11-02
OSVUSN-3703-1 No score
libarchive-zip-perl vulnerability
It was discovered that the Archive Zip module incorrectly handled certain inputs. An attacker could possibly use this to access sensitive information.
- Record
USN-3703-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libarchive-zip-perlDebian:12 |
before 1.62-1 | 1.62-1 |
libarchive-zip-perlDebian:13 |
before 1.62-1 | 1.62-1 |
libarchive-zip-perlDebian:14 |
before 1.62-1 | 1.62-1 |
libarchive-zip-perlDebian:8 |
before 1.39-1+deb8u1, plus listed versions 1.39-1 |
1.39-1+deb8u1 |
libarchive-zip-perlDebian:9 |
before 1.59-1+deb9u1, plus listed versions 1.59-1 |
1.59-1+deb9u1 |
perl-Archive-ZipMageia:6 |
before 1.600.0-1.mga6 | 1.600.0-1.mga6 |
perl-Archive-ZipSUSE:Linux Enterprise Desktop 12 SP3 |
before 1.34-3.3.1 | 1.34-3.3.1 |
perl-Archive-ZipSUSE:Linux Enterprise Server 12 SP3 |
before 1.34-3.3.1 | 1.34-3.3.1 |
perl-Archive-ZipSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.34-3.3.1 | 1.34-3.3.1 |
perl-Archive-ZipSUSE:Linux Enterprise Module for Basesystem 15 |
before 1.60-3.3.1 | 1.60-3.3.1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-Archive-ZipSUSE:Linux Enterprise Server 11 SP4 |
before 1.24-4.3.1 | 1.24-4.3.1 |
perl-Archive-ZipSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 1.24-4.3.1 | 1.24-4.3.1 |
libarchive-zip-perlUbuntu:14.04:LTS |
before 1.30-7ubuntu0.1, plus listed versions 1.30-7 |
1.30-7ubuntu0.1 |
libarchive-zip-perlUbuntu:16.04:LTS |
before 1.56-2ubuntu0.1, plus listed versions 1.49-11.53-11.55-11.56-2 |
1.56-2ubuntu0.1 |
libarchive-zip-perlUbuntu:18.04:LTS |
before 1.60-1ubuntu0.1, plus listed versions 1.59-11.60-1 |
1.60-1ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-10860 is a medium vulnerability (CVSS 5.4) in [unknown] Perl-archive-zip, published June 29, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 42.2%, the 98th percentile. Fixed in libarchive-zip-perl 1.62-1.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10860
lists.debian.org/debian-lts-announce/2018/07/msg00032.html
usn.ubuntu.com/3703-2
securityfocus.com/bid/104580
debian.org/security/2018/dsa-4300
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-10860
github.com/advisories/GHSA-46vh-339r-h4rg
security-tracker.debian.org/tracker/CVE-2018-10860
advisories.mageia.org/MGASA-2018-0311.html
bugs.mageia.org/show_bug.cgi?id=23285
suse.com/support/update/announcement/2018/suse-su-20182385-1
bugzilla.suse.com/1099497
ubuntu.com/security/CVE-2018-10860
cve.org/CVERecord?id=CVE-2018-10860