CVE-2022-21675CWE-22

Bytecode Viewer v2.10.x Zip Slip

Critical · published January 12, 2022

CVSS v3.1
9.9
EPSS
3%
Percentile
84.9
In the wild
Unconfirmed
What it is

🚨 A crafted archive is all an attacker needs to execute arbitrary commands! This Zip Slip vulnerability in Bytecode Viewer lets malicious archives sneak in and overwrite files like a sneaky raccoon rummaging through your trash. 🔥 Think of this like a delivery driver who doesn’t bother to check the address and ends up delivering a load of unwanted packages right into your living room instead of the intended destination. If they’re crafty enough, they can even slip in a package disguised as something harmless while hiding a dangerous surprise inside! An attacker could exploit this vulnerability to create or overwrite crucial files on a victim's filesystem, potentially endangering sensitive data or granting them remote control of the system. Imagine waking up to find a malicious file executed right under your nose, all thanks to an unsuspecting archive — absolutely devastating!

Put simply

Think of this like a delivery driver who doesn’t bother to check the address and ends up delivering a load of unwanted packages right into your living room instead of the intended destination. If they’re crafty enough, they can even slip in a package disguised as something harmless while hiding a dangerous surprise inside! The Zip Slip vulnerability in Bytecode Viewer allows an attacker to manipulate archive files with directory traversal patterns, enabling them to overwrite existing files or create new ones. This exploitation can lead to remote command execution on the victim's machine whenever the affected file is invoked.

What to do

An attacker could exploit this vulnerability to create or overwrite crucial files on a victim's filesystem, potentially endangering sensitive data or granting them remote control of the system. Imagine waking up to find a malicious file executed right under your nose, all thanks to an unsuspecting archive — absolutely devastating! Upgrade to Bytecode Viewer version 2.11.0 immediately to patch this critical vulnerability. Unfortunately, there are no workarounds, so this should be treated as an urgent priority for all users! You've got this! With a quick upgrade, you’ll lock down your system and keep those raccoons at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02544 · 84.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2022-01-12T18:20Z
EPSS history
Timeline
  • 12 JAN 18:20Z
    Bytecode Viewer v2.10.x Zip Slip
    cvelistv5