Every CVE Search/ Get API key

CVE-2023-46122

Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt

3.9 LowFix available

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.37%Up 0.3 points since Oct 24, 2023
90%50%10%1%

What each source reports

CVE List Score used 3.9

Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Record
CVE-2023-46122
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2023-2746 3.9

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Record
EUVD-2023-2746
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-h9mw-grgx-2fhf 3.9

sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)

Impact

Given specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. The follow is an example of a malicious entry:

+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys

This would have a potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks - https://github.com/search?q=IO.unzip+language%3AScala&type=code&l=Scala&p=1

Patches

The problem has been patched in https://github.com/sbt/io/pull/360 sbt 1.9.7 is available with the fix.

Workarounds

A workaround might be use some other library to unzip.

References

Record
GHSA-h9mw-grgx-2fhf
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
NVD 3.9

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Record
CVE-2023-46122
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSV 3.9

Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbt

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Record
CVE-2023-46122
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-h9mw-grgx-2fhf 3.9

sbt vulnerable to arbitrary file write via archive extraction (Zip Slip)

Impact

Given specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. The follow is an example of a malicious entry:

+2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys

This would have a potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks - https://github.com/search?q=IO.unzip+language%3AScala&type=code&l=Scala&p=1

Patches

The problem has been patched in https://github.com/sbt/io/pull/360 sbt 1.9.7 is available with the fix.

Workarounds

A workaround might be use some other library to unzip.

References

Record
GHSA-h9mw-grgx-2fhf
CVSS 3.1
3.9 LowCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-22
Updated
2026-11-02
OSVOESA-2024-2422 7.1

sbt security update

sbt is the simple build tool for Scala and Java projects.

Security Fix(es):

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, IO.unzip allows writing of arbitrary file. This would have potential to overwrite /root/.ssh/authorized_keys. Within sbt's main code, IO.unzip is used in pullRemoteCache task and Resolvers.remote; however many projects use IO.unzip(...) directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.(CVE-2023-46122)

Record
OESA-2024-2422
CVSS 3.1
7.1 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Updated
2026-11-02
OSVSUSE-SU-2023:4527-1 No score

Security update for maven, maven-resolver, sbt, xmvn

This update for maven, maven-resolver, sbt, xmvn fixes the following issues:

  • CVE-2023-46122: Fixed an arbitrary file write when extracting a crafted zip file with sbt (bsc#1216529).
  • Upgraded maven to version 3.9.4
  • Upgraded maven-resolver to version 1.9.15.
Record
SUSE-SU-2023:4527-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.scala-sbt:sbt
Maven
 0.3.4 up to 1.9.7
1.9.7
org.scala-sbt:io_2.12
Maven
 1.0.0 up to 1.9.7
1.9.7
org.scala-sbt:io_2.13
Maven
 1.0.0 up to 1.9.7
1.9.7
org.scala-sbt:io_3
Maven
 1.0.0 up to 1.9.7
1.9.7
org.scala-sbt:sbt
Maven
 0.3.4 up to 1.9.7, plus listed versions
0.99.20.99.41.0.01.0.0-M11.0.0-M2
Show 45 moreShow less
1.0.0-M31.0.0-M41.0.0-M51.0.0-M61.0.0-RC11.0.0-RC21.0.0-RC31.0.11.0.21.0.31.0.41.1.01.1.0-M11.1.0-RC11.1.0-RC21.1.0-RC31.1.0-RC41.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.0-M11.2.0-RC11.2.0-RC21.2.0-RC31.2.11.2.21.2.31.2.41.2.51.2.61.2.71.2.81.3.01.3.0-M11.3.0-M21.3.0-M31.3.0-M41.3.0-M51.3.0-M5-94d5ec1.3.0-RC11.3.0-RC2
1.9.7
org.scala-sbt:io_2.12
Maven
 1.0.0 up to 1.9.7, plus listed versions
1.0.11.0.21.1.01.1.11.1.10
Show 45 moreShow less
1.1.21.1.31.1.41.1.51.1.61.1.71.1.81.1.91.2.01.2.0-M11.2.0-M21.2.11.2.21.3.01.3.0-M11.3.0-M101.3.0-M111.3.0-M121.3.0-M131.3.0-M141.3.0-M151.3.0-M161.3.0-M171.3.0-M181.3.0-M21.3.0-M31.3.0-M41.3.0-M51.3.0-M61.3.0-M71.3.0-M81.3.0-M91.3.11.3.21.3.31.3.41.4.01.4.0-M11.4.0-M21.4.0-M31.4.0-M41.4.0-M51.4.0-M61.4.0-M71.4.0-M8
1.9.7
org.scala-sbt:io_2.13
Maven
 1.0.0 up to 1.9.7, plus listed versions
1.3.01.3.0-M111.3.0-M121.3.0-M131.3.0-M14
Show 30 moreShow less
1.3.0-M151.3.0-M161.3.0-M171.3.0-M181.3.11.3.21.3.31.3.41.4.01.4.0-M11.4.0-M21.4.0-M31.4.0-M41.4.0-M51.4.0-M61.4.0-M71.4.0-M81.5.01.5.0-M11.5.11.6.01.6.0-M11.6.0-M21.7.01.8.01.8.11.9.01.9.0-M11.9.0-RC31.9.1
1.9.7
org.scala-sbt:io_3
Maven
 1.0.0 up to 1.9.7, plus listed versions
1.6.01.6.0-M21.7.01.8.01.8.1
Show 4 moreShow less
1.9.01.9.0-M11.9.0-RC31.9.1
1.9.7
sbt
openEuler:24.03-LTS
 before 0.13.1-6.oe2403
0.13.1-6.oe2403
sbt
openEuler:22.03-LTS-SP4
 before 0.13.1-3.oe2203sp4
0.13.1-3.oe2203sp4
Show 83 moreShow less
Affected packages
PackageAffectedFixed
sbt
openEuler:22.03-LTS-SP3
 before 0.13.1-3.oe2203sp3
0.13.1-3.oe2203sp3
sbt
openEuler:20.03-LTS-SP4
 before 0.13.1-3.oe2003sp4
0.13.1-3.oe2003sp4
sbt
openEuler:22.03-LTS-SP1
 before 0.13.1-3.oe2203sp1
0.13.1-3.oe2203sp1
maven
SUSE:Linux Enterprise Module for Development Tools 15 SP4
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Linux Enterprise Module for Development Tools 15 SP4
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Linux Enterprise Module for Development Tools 15 SP4
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Linux Enterprise Module for Development Tools 15 SP4
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Linux Enterprise Module for Development Tools 15 SP4
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Linux Enterprise Module for Development Tools 15 SP4
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
SUSE:Linux Enterprise Module for Development Tools 15 SP5
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Linux Enterprise Module for Development Tools 15 SP5
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Linux Enterprise Module for Development Tools 15 SP5
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Linux Enterprise Module for Development Tools 15 SP5
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Linux Enterprise Module for Development Tools 15 SP5
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Linux Enterprise Module for Development Tools 15 SP5
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
sbt
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 0.13.18-150200.4.16.1
0.13.18-150200.4.16.1
sbt-bootstrap
SUSE:Linux Enterprise Module for Package Hub 15 SP5
 before 0.13.18-150200.4.16.1
0.13.18-150200.4.16.1
maven
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Linux Enterprise Server 15 SP2-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Linux Enterprise Server 15 SP3-LTSS
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Linux Enterprise Server for SAP Applications 15 SP3
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
SUSE:Enterprise Storage 7.1
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
SUSE:Enterprise Storage 7.1
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
xmvn
SUSE:Enterprise Storage 7.1
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
SUSE:Enterprise Storage 7.1
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
SUSE:Enterprise Storage 7.1
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
SUSE:Enterprise Storage 7.1
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
openSUSE:Leap 15.4
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
openSUSE:Leap 15.4
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
sbt
openSUSE:Leap 15.4
 before 0.13.18-150200.4.16.1
0.13.18-150200.4.16.1
sbt-bootstrap
openSUSE:Leap 15.4
 before 0.13.18-150200.4.16.1
0.13.18-150200.4.16.1
xmvn
openSUSE:Leap 15.4
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
openSUSE:Leap 15.4
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
openSUSE:Leap 15.4
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-parent
openSUSE:Leap 15.4
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
openSUSE:Leap 15.4
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
maven
openSUSE:Leap 15.5
 before 3.9.4-150200.4.18.1
3.9.4-150200.4.18.1
maven-resolver
openSUSE:Leap 15.5
 before 1.9.15-150200.3.14.2
1.9.15-150200.3.14.2
sbt
openSUSE:Leap 15.5
 before 0.13.18-150200.4.16.1
0.13.18-150200.4.16.1
sbt-bootstrap
openSUSE:Leap 15.5
 before 0.13.18-150200.4.16.1
0.13.18-150200.4.16.1
xmvn
openSUSE:Leap 15.5
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-connector
openSUSE:Leap 15.5
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-mojo
openSUSE:Leap 15.5
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-parent
openSUSE:Leap 15.5
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1
xmvn-tools
openSUSE:Leap 15.5
 before 4.2.0-150200.3.14.1
4.2.0-150200.3.14.1

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-46122 is a low vulnerability (CVSS 3.9) in Sbt, published October 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in org.scala-sbt:sbt 1.9.7.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 88 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open