CVE-2022-26049 Arbitrary File Write via Archive Extraction (Zip Slip)

What is CVE-2022-26049?

CVE-2022-26049 is a medium-severity path traversal vulnerability in com.diffplug.gradle:goomph, published on 11 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability. **Note:** This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.

Weakness: CWE-22

Which versions are affected by CVE-2022-26049?

2 open source packages ship an affected version, including com.diffplug.gradle:goomph. It affects 1 product.

Products include Diffplug Goomph.

How do I fix CVE-2022-26049?

Upgrade com.diffplug.gradle:goomph to 3.37.2 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-26049 being exploited?

There is no known exploitation of CVE-2022-26049 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p2f7-9cv7-jjf6.