Soumettre #862473: ZJONSSON node-unzipper 0.12.3 Path Traversal

A path traversal / Zip Slip vulnerability exists in ZJONSSON/node-unzipper, npm package unzipper, version 0.12.3.

The vulnerability is caused by unsafe extraction path validation. The affected code builds the destination path with path.join() and then checks whether the resulting path starts with the configured extraction directory using a raw string-prefix comparison:

extractPath.indexOf(opts.path) != 0

This is not a proper directory-boundary check. If the intended extraction directory is named "out", a crafted ZIP entry such as "../out2/evil.txt" resolves to the sibling directory "out2". The resulting path still begins with the string prefix of the configured extraction path, so the check passes even though the file is outside the intended extraction directory.

The issue affects at least the following extraction APIs:

unzipper.Extract({ path })
Open.*.extract({ path })

The PoC creates a ZIP archive containing one file entry:

../out2/evil.txt

The archive is extracted into:

_local_prefix_poc/out

Expected result:
The entry should be rejected because it resolves outside the configured extraction root.

Actual result:
The file is written outside the extraction root into the sibling directory:

_local_prefix_poc/out2/evil.txt

Observed PoC output:

escaped_exists=true
inside_exists=false
escaped_content=NODE_UNZIPPER_PREFIX_TRAVERSAL

Successful exploitation allows an attacker to write files outside the intended ZIP extraction directory when a vulnerable application extracts attacker-controlled ZIP archives. Depending on the application deployment, this may allow writing to sibling directories, overwriting application-controlled files, placing attacker-controlled files in web-served directories, or potentially achieving code execution if the written file is later loaded or executed by the application.

Suggested fix:
The vulnerable string-prefix check should be replaced with canonical path resolution and directory-boundary validation using path.resolve() and path.relative(). The destination should only be accepted if it remains inside the configured extraction root.

Estimated severity:
High. Suggested CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H, score 8.1.

For more POC details, please see my issue: https://github.com/ZJONSSON/node-unzipper/issues/357

• La source: ⚠️ https://github.com/ZJONSSON/node-unzipper/issues/357
• Utilisateur: zyhhoward (UID 97563)
• Soumission: 18/06/2026 05:41 (il y a 1 mois)
• Modérer: 27/07/2026 09:18 (1 month later)
• Statut: Accepté
• Entrée VulDB: 383384 [ZJONSSON node-unzipper jusqu’à 0.12.3 lib/extract.js Extract directory traversal]
• Points: 20