A directory traversal vulnerability in the zip-lib package before version 1.1.0 allows unauthenticated attackers to bypass security controls during archive extraction.

This is a directory traversal vulnerability (CWE-22) residing in the path validation caching mechanism. An unauthenticated attacker can exploit this flaw during the extraction process to write files to arbitrary locations on the host system.

Successful exploitation of this vulnerability could lead to unauthorized file system access, potentially allowing an attacker to overwrite critical system files or place malicious scripts on the server. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to system integrity and could be leveraged to gain remote code execution or escalate privileges within the environment.

Immediate Action: Update the zip-lib package to version 1.1.0 or later to ensure the path validation mechanism is correctly patched.

Proactive Monitoring: Monitor application logs for unusual file system write operations or unexpected directory access patterns originating from the zip-lib utility.

Compensating Controls: Ensure that the application running zip-lib operates with the principle of least privilege, specifically restricting the permissions of the service account to only the directories required for its function.

Public Exploit Available: No

The severity of this directory traversal flaw necessitates an immediate upgrade to the patched version. Administrators should prioritize updating the zip-lib package across all affected environments to prevent potential unauthorized file system manipulation.