CVE-2018-1002203

unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during ex...

Public exploit available. Not confirmed exploited in the wild yet. Fixed in 0.8.13.

CVSS 3.05.5Medium EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source Fix0.8.13Upgrade to this build

Published 2018-07-25Updated 2024-11-21Sources: CVE.org, NVD, GitHub

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

Node.js UnzipperAffected: ≥ unspecified, < 0.8.13Upgrade to: 0.8.13Stated by: CVE record
Npm UnzipperAffected: < 0.8.13Upgrade to: 0.8.13Stated by: GitHub advisory
Unzipper Project UnzipperAffected: < 0.8.13Upgrade to: 0.8.13Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check your project’s dependency list or lockfile for unzipper versions before 0.8.13.
Update unzipper to version 0.8.13 or later.
Until updated, do not extract Zip files from untrusted sources with the affected application.
Review recently extracted untrusted archives and investigate unexpected file changes outside extraction folders.

npm install unzipper@^0.8.13

Vendor advisory Usually a quick update

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Arbitrary File Write via Archive Extraction in unzipper

In plain language

Written by AI from the record

unzipper versions before 0.8.13 can let a harmful Zip file write files outside its intended folder, so businesses using it should update.

CWE-22 directory traversal in unzipper archive-entry path handling permits arbitrary local file writes when a user extracts a crafted Zip archive.

If you're affected

Unauthorized file changes
Application configuration overwrite
Service disruption
Potential malware placement

What is it

This is a flaw in software that opens Zip files. A malicious archive can include instructions that make files land somewhere else on the computer, like a delivery addressed to a storage room but redirected into the office safe.

Who is affected

This matters to you if your application uses unzipper to open or extract Zip files. It is only a risk when someone processes a crafted Zip archive with the vulnerable library.

How urgent is it

An attacker must get a harmful Zip file processed by your application to carry out this attack. Public proof-of-concept code exists, so treat this as a planned near-term update and restrict untrusted archive extraction until it is complete.

What to do — in detail

Confirm exposure by checking package.json plus the installed dependency tree and lockfile for unzipper versions below 0.8.13. Upgrade to unzipper 0.8.13 or later, run the application’s archive-extraction tests, and deploy the updated lockfile with the application. No breaking-change information is provided in the findings; validate extraction paths and expected archive behavior in a test environment before production deployment. If patching is delayed, prevent the application from processing untrusted Zip archives or isolate that processing in a restricted environment with write access limited to a dedicated extraction directory. This CVE is not listed in CISA KEV, so there is no CISA remediation due date. Monitor for unexpected files or modified configuration files outside intended extraction directories after processing archives.

Technical context

CVSS v3.0 is 5.5 (Medium): AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. The vulnerability is CWE-22 directory traversal (Zip Slip), enabling arbitrary local filesystem writes through ../ sequences in archive entry names during extraction. A public GitHub proof of concept is known. EPSS predicts a 10.6% likelihood (96th percentile) and is flat. It is not listed in CISA KEV; no confirmed exploitation is provided in the findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 471 days before any public exploit.

2026-09-23EPSS band change0 → moderateepss band change
2026-09-21EPSS band changemoderate → 0epss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

npmpackage-ecosystem
- unzipperOSS Libraries
unzipper projectaka unzipper
- unzipperLibraryOSS Libraries / generic-library
node.jsoss-projectaka nodejs
- unzipperLibraryOSS Libraries / generic-library

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Scored 5.5 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction RequiredA user must click a link, open a file, or perform some action

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability NoneNo availability impact