CVE-2022-23793 [20220301] - Core - Zip Slip within the Tar extractor

What is CVE-2022-23793?

CVE-2022-23793 is a high-severity path traversal vulnerability in Joomla Joomla\!, published on 30 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.

Weakness: CWE-22

Which versions are affected by CVE-2022-23793?

5 open source packages ship an affected version, including joomla/archive and joomla. It affects 1 product.

Products include Joomla Joomla\!.

How do I fix CVE-2022-23793?

Upgrade joomla/archive to a fixed version for your release line: 1.1.12 or 2.0.1.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-23793 being exploited?

There is no known exploitation of CVE-2022-23793 in the wild and no public exploit code.

Other vulnerabilities in Joomla Joomla\!

• CVE-2016-10033 PHPMailer Command Injection Exploited Critical 9.8
• CVE-2023-23752 Joomla! Improper Access Control Exploited Medium 5.3
• CVE-2026-48902 Joomla! Core - [20260518] - Transport encryption downgrade for password and username reset links Critical 9.8
• CVE-2025-25226 [20250401] - Joomla Framework - SQL injection vulnerability in quoteNameStr method of Database package Critical 9.8
• CVE-2022-23795 [20220303] - Core - User row are not bound to a authentication mechanism Critical 9.8

All Joomla Joomla\! vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-joomla-2022-23793, GHSA-jm67-jh3g-cg3f.