{"action":"Upgrade org.zeroturnaround:zt-zip to 1.13 or later.","affected":[{"fixed":"1.13","introduced":"0"}],"component":"org.zeroturnaround:zt-zip","cve_ids":["CVE-2018-1002201"],"ecosystem":"Maven","epss":0.10437,"exploited":false,"fixed_versions":["1.13"],"ghsa_id":"GHSA-qcf3-9vmh-xw4r","id":"tcs_01M5N998BK7HW19GQVKYNPMGNB","modified_at":"2026-09-10T03:49:36.520555713Z","published_at":"2022-05-13T01:30:44Z","references":["https://osv.dev/vulnerability/GHSA-qcf3-9vmh-xw4r","https://nvd.nist.gov/vuln/detail/CVE-2018-1002201","https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff","https://github.com/snyk/zip-slip-vulnerability","https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt","https://snyk.io/research/zip-slip-vulnerability","https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-qcf3-9vmh-xw4r","url":"https://osv.dev/vulnerability/GHSA-qcf3-9vmh-xw4r"}],"summary":"Improper Limitation of a Pathname to a Restricted Directory in zt-zip"}