Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZnd3ItNzczcS03ajNj

Path Traversal within joomla/archive zip class

An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.

Permalink: https://github.com/advisories/GHSA-vgwr-773q-7j3c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZnd3ItNzczcS03ajNj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: almost 2 years ago

Identifiers: GHSA-vgwr-773q-7j3c, CVE-2021-26028
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-26028
• https://github.com/joomla-framework/archive/commit/32c9009a1020d16bc1060c0d06339898b697cf2c
• https://developer.joomla.org/security-centre/848-20210308-core-path-traversal-within-joomla-archive-zip-class.html
• https://github.com/FriendsOfPHP/security-advisories/blob/master/joomla/archive/CVE-2021-26028.yaml
• https://github.com/advisories/GHSA-vgwr-773q-7j3c

Repository: https://github.com/joomla-framework/archive
Blast Radius: 0.0

Affected Packages