Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1tN3I4LTJyOTgtdnBwas4AA9Sw

Zip slip in opencart

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability.

Permalink: https://github.com/advisories/GHSA-m7r8-2r98-vppj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tN3I4LTJyOTgtdnBwas4AA9Sw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: about 1 month ago


CVSS Score: 7.2
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-m7r8-2r98-vppj, CVE-2024-21518
References: Repository: https://github.com/opencart/opencart
Blast Radius: 8.5

Affected Packages

packagist:opencart/opencart
Dependent packages: 12
Dependent repositories: 15
Downloads: 34,604 total
Affected Version Ranges: >= 4.0.0.0
No known fixed version
All affected versions: