{"action":"Upgrade org.codehaus.plexus:plexus-archiver to 3.6.0 or later.","affected":[{"fixed":"3.6.0","introduced":"0"}],"component":"org.codehaus.plexus:plexus-archiver","cve_ids":["CVE-2018-1002200"],"ecosystem":"Maven","epss":0.11579,"exploited":false,"fixed_versions":["3.6.0"],"ghsa_id":"GHSA-hcxq-x77q-3469","id":"tcs_01M5N90C5CC24Z6HDF84AM6Y5J","modified_at":"2026-09-10T03:49:33.757662645Z","published_at":"2022-05-13T01:35:03Z","references":["https://osv.dev/vulnerability/GHSA-hcxq-x77q-3469","https://nvd.nist.gov/vuln/detail/CVE-2018-1002200","https://github.com/codehaus-plexus/plexus-archiver/pull/87","https://github.com/codehaus-plexus/plexus-archiver/commit/f8f4233508193b70df33759ae9dc6154d69c2ea8","https://access.redhat.com/errata/RHSA-2018:1836","https://access.redhat.com/errata/RHSA-2018:1837","https://github.com/codehaus-plexus/plexus-archiver","https://github.com/snyk/zip-slip-vulnerability","https://snyk.io/research/zip-slip-vulnerability","https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680","https://www.debian.org/security/2018/dsa-4227"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-hcxq-x77q-3469","url":"https://osv.dev/vulnerability/GHSA-hcxq-x77q-3469"}],"summary":"Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver"}