{"id":"CVE-2019-9195","aliases":["EUVD-2019-18571","GHSA-v6c9-7f38-qq3j"],"status":"published","title":"util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute...","description":"util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03588,"percentile":0.89504,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2019-02-26T19:00:00Z","modified":"2026-10-20T10:50:03Z","products":[{"vendor":"grin","product":"grin"}],"references":[{"url":"https://www.grin-forum.org/t/critical-vulnerability-in-grin-1-0-1-and-older-fixed-in-1-0-2/4343","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/mimblewimble/grin/releases/tag/v1.0.2","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://github.com/mimblewimble/grin/pull/2624","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9195"},{"url":"https://github.com/advisories/GHSA-v6c9-7f38-qq3j"}],"sources":{"cve":[{"id":"CVE-2019-9195","description":"util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive.","status":"published","published":"2019-02-26T19:00:00Z","modified":"2024-08-04T21:38:46.569Z","updated_at":"2026-11-02T14:20:20.397093Z"}],"euvd":[{"id":"EUVD-2019-18571","description":"util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive.","status":"published","published":"2019-02-26T19:00:00Z","modified":"2024-08-04T21:38:46Z","updated_at":"2026-11-03T03:06:39.848951Z"}],"ghsa":[{"id":"GHSA-v6c9-7f38-qq3j","title":"util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute...","description":"util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive.","status":"published","published":"2022-05-13T01:28:43Z","modified":"2023-02-01T05:07:48Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:50:37.203795Z"}],"nvd":[{"id":"CVE-2019-9195","description":"util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive.","status":"published","published":"2019-02-26T19:29:00.377Z","modified":"2026-06-17T02:43:20.023Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:05:04.689371Z"}],"osv":[{"id":"CVE-2019-9195","description":"util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive.","status":"published","published":"2019-02-26T19:29:00.377Z","modified":"2026-10-20T10:50:03.767071437Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.974481Z"}]}}