{"id":"CVE-2023-39138","aliases":["EUVD-2023-2266","GHSA-c2cc-3569-6jh2"],"status":"published","title":"Path traversal in ZIPFoundation","description":"An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00409,"percentile":0.35429,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2023-08-30T00:00:00Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"SwiftURL","package":"github.com/weichsel/ZIPFoundation","fixed_in":["0.9.18"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"SwiftURL","package":"github.com/weichsel/ZIPFoundation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.9.17"},{"fixed":"0.9.18"}]}]},{"source":"osv","ecosystem":"SwiftURL","package":"github.com/weichsel/ZIPFoundation","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.18"}]}]}],"products":[{"vendor":"peakstep","product":"zipfoundation"}],"references":[{"url":"https://github.com/weichsel/ZIPFoundation/issues/282","tags":["x_transferred","Issue Tracking","report","web"]},{"url":"https://blog.ostorlab.co/zip-packages-exploitation.html","tags":["x_transferred","Exploit","article","web"]},{"url":"https://ostorlab.co/vulndb/advisory/OVE-2023-4","tags":["x_transferred","Exploit","advisory","web"]},{"url":"https://ostorlab.co/vulndb/advisory/OVE-2023-6","tags":["x_transferred","Exploit","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39138","tags":["advisory"]},{"url":"https://github.com/weichsel/ZIPFoundation/releases/tag/0.9.18","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c2cc-3569-6jh2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39138.json","tags":["advisory"]},{"url":"https://github.com/weichsel/ZIPFoundation","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-39138","description":"An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.","status":"published","published":"2023-08-30T00:00:00Z","modified":"2024-10-02T13:55:21.776Z","updated_at":"2026-11-02T14:35:33.462059Z"}],"euvd":[{"id":"EUVD-2023-2266","description":"An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.","status":"published","published":"2023-08-30T00:00:00Z","modified":"2024-10-02T13:55:21Z","updated_at":"2026-11-03T00:27:59.473662Z"}],"ghsa":[{"id":"GHSA-c2cc-3569-6jh2","title":"Path traversal in ZIPFoundation","description":"An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.","status":"published","published":"2023-08-31T00:30:17Z","modified":"2024-02-09T00:32:42Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:37:36.777238Z"}],"nvd":[{"id":"CVE-2023-39138","description":"An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.","status":"published","published":"2023-08-30T22:15:09.083Z","modified":"2026-06-17T06:11:37.297Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:27.181588Z"}],"osv":[{"id":"GHSA-c2cc-3569-6jh2","title":"Path traversal in ZIPFoundation","description":"An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.","status":"published","published":"2023-08-31T00:30:17Z","modified":"2024-02-09T00:32:41Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:44.225359Z"},{"id":"CVE-2023-39138","description":"An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.","status":"published","published":"2023-08-30T00:00:00Z","modified":"2026-10-28T02:30:48.339867783Z","updated_at":"2026-11-02T15:44:32.922049Z"}]}}