CVE-2022-0401: Path Traversal in w-zip
Summary
CVE-2022-0401: Path Traversal in w-zip. Affects w-zip versions < 1.0.12. Fixed in 1.0.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The w-zip package is an npm package used for zipping files. It provides functionality to create and extract zip archives. The package is widely used in various applications for file compression and archival purposes. However, prior to version 1.0.12, the package is vulnerable to a path traversal attack.
Vulnerability Detail
The vulnerability in w-zip allows an attacker to traverse outside the intended directory and access files or directories on the host system. This can lead to unauthorized access, disclosure of sensitive information, or even remote code execution. The vulnerability originates from improper handling of user-supplied input when specifying the file or directory to be zipped or extracted. By manipulating the input, an attacker can bypass the intended restrictions and access arbitrary files or directories.
How To Fix
Latest published version: 1.0.48 as of 22 Oct 2026
npm install w-zip@1.0.48Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.12
This is the first release that contains the fix.
npm install w-zip@1.0.12Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to implement input validation and sanitization measures in the application code. When specifying the file or directory to be zipped or extracted, ensure that the input is restricted to the intended directory and does not allow traversal outside of it. This can be achieved by validating and sanitizing the input to remove any relative path components or disallowing certain characters that could be used for traversal.
Conclusion
In conclusion, the w-zip package prior to version 1.0.12 is vulnerable to a path traversal attack. This can lead to unauthorized access, disclosure of sensitive information, or remote code execution. It is crucial to upgrade to the latest version or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for w-zip →
FAQ
The vulnerability allows an attacker to access arbitrary files or directories on the host system, potentially leading to unauthorized access, disclosure of sensitive information, or remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json without requiring access to the code or installation.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fix to mitigate the risk.
If upgrading to the latest version is not immediately possible, implement input validation and sanitization measures in your application code to restrict the input to the intended directory and prevent path traversal. Additionally, consider implementing other security measures such as access controls and monitoring to detect any potential exploitation attempts.
