medium 5.5

CVE-2018-17828 json

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, becaus…

published 2018-10-01 8 y ago modified 2026-10-15 24 d ago also EUVD-2018-9574

cvss: 5.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.5%; EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits: 0; none known

Directory traversal vulnerability in ZZIPlib 0.13.69 allows attackers to overwrite arbitrary files via a .. (dot dot) in a zip file, because of the function unzzip_cat in the bins/unzzipcat-mem.c file.

Patch / fix

distros 7 links 1

red hat suse opensuse almalinux rocky linux alpine azure linux

zziplib RHEL 9 0.13.71-12.el9
zziplib-utils RHEL 9 0.13.71-12.el9
zziplib RHEL 10.1 0.13.78-2.el10
zziplib-utils RHEL 10.1 0.13.78-2.el10
zziplib RHEL 8 0.13.68-8.el8
zziplib-utils RHEL 8 0.13.68-8.el8
zziplib RHEL 7 0.13.62-12.el7
zziplib-utils RHEL 7 0.13.62-12.el7

red hat advisories RHSA-2025:20838 RHSA-2025:20478 RHSA-2020:1653 RHSA-2020:1178

zziplib SLED 12 SP3, SLE Workstation Extension 12 SP3, SLE Software Development Kit 12 SP3 0.13.67-10.14.1
zziplib SLE Module for Basesystem 15 0.13.69-3.3.1

suse advisories SUSE-SU-2018:3379-1 SUSE-SU-2018:3220-1

zziplib openSUSE Tumbleweed 0.13.72-1.4

opensuse advisories openSUSE-SU-2024:11546-1

zziplib AlmaLinux 10 0.13.78-2.el10
zziplib-utils AlmaLinux 10 0.13.78-2.el10
zziplib AlmaLinux 9 0.13.71-12.el9
zziplib-utils AlmaLinux 9 0.13.71-12.el9

almalinux advisories ALSA-2025:20478 ALSA-2025:20838

zziplib Rocky Linux 10 0.13.78-2.el10
zziplib Rocky Linux 9 0.13.71-12.el9
zziplib Rocky Linux 8 0.13.68-8.el8

rocky linux advisories RLSA-2025:20478 RLSA-2025:20838 RLSA-2020:1653

zziplib Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 0.13.69-r2

alpine advisories ALPINE-CVE-2018-17828

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

zziplib CBL-Mariner 2.0 0.13.69-8

azure linux advisories AZL-7014 AZL-7458

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/gdraheim/zziplib/issues/62 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-17828 updated 2026-11-07 cvss 5.5

zziplib: ZZIPlib: Arbitrary file overwrite via directory traversal

Red Hat CodeReady Linux Builder (v. 8) zziplib-devel 0.13.68-8.el8, zziplib-debuginfo 0.13.68-8.el8, zziplib-debugsource 0.13.68-8.el8, zziplib-utils-debuginfo 0.13.68-8.el8 Red Hat Enterprise Linux AppStream (v. 8) zziplib 0.13.68-8.el8, zziplib-utils 0.13.68-8.el8
fixed: vendor fix RHSA-2020:1653
Red Hat Enterprise Linux AppStream (v. 9) zziplib 0.13.71-12.el9, zziplib-utils 0.13.71-12.el9
fixed: vendor fix RHSA-2025:20838
Red Hat Enterprise Linux AppStream (v. 10) zziplib 0.13.78-2.el10, zziplib-utils 0.13.78-2.el10
fixed: vendor fix RHSA-2025:20478
Red Hat Enterprise Linux Client (v. 7) zziplib 0.13.62-12.el7 Red Hat Enterprise Linux Client Optional (v. 7) zziplib-utils 0.13.62-12.el7
fixed: vendor fix RHSA-2020:1178
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) zziplib-devel 0.13.71-12.el9, zziplib-debuginfo 0.13.71-12.el9, zziplib-debugsource 0.13.71-12.el9, zziplib-utils-debuginfo 0.13.71-12.el9
fixed: vendor fix RHSA-2025:20838
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) zziplib-devel 0.13.78-2.el10, zziplib-debuginfo 0.13.78-2.el10, zziplib-debugsource 0.13.78-2.el10, zziplib-utils-debuginfo 0.13.78-2.el10
fixed: vendor fix RHSA-2025:20478
Red Hat Enterprise Linux ComputeNode Optional (v. 7) zziplib 0.13.62-12.el7, zziplib-utils 0.13.62-12.el7 Red Hat Enterprise Linux Server (v. 7) zziplib 0.13.62-12.el7 Red Hat Enterprise Linux Server Optional (v. 7) zziplib-utils 0.13.62-12.el7 Red Hat Enterprise Linux Workstation (v. 7) zziplib 0.13.62-12.el7 Red Hat Enterprise Linux Workstation Optional (v. 7) zziplib-utils 0.13.62-12.el7
fixed: vendor fix RHSA-2020:1178

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 24 d ago (2026-10-15)

Exploit prediction

1.48% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/gdraheim/zziplib/issues/62 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.5	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:N/I:P/A:P

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

github.com /gdraheim/zziplib/issues/62
exploit, patch, third-party-advisory

Sources

CVE List CVE-2018-17828
NVD CVE-2018-17828

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary