What’s Vulnerable › Vulnerabilities

CVE-2017-1000472

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-01-03 · updated 2026-06-17
• Weakness: CWE-22

Description

The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO C++ Libraries before 1.8 does not properly restrict the filename value in the ZIP header, which allows attackers to conduct absolute path traversal attacks during the ZIP decompression, and possibly create or overwrite arbitrary files, via a crafted ZIP file, related to a "file path injection vulnerability".

Affected products

• Debian Linux: 8.0, 9.0
• poco: before 1.8 — fixed in 1.8

How to fix

Upgrade to a fixed version: poco 1.8. Check the vendor advisory for mitigations.

References

• https://github.com/pocoproject/poco/issues/1968
• https://lists.debian.org/debian-lts-announce/2018/01/msg00013.html
• https://www.debian.org/security/2018/dsa-4083
• https://github.com/pocoproject/poco/issues/1968
• https://lists.debian.org/debian-lts-announce/2018/01/msg00013.html
• https://www.debian.org/security/2018/dsa-4083

Get alerted when CVE-2017-1000472 or the next vulnerability affects your stack