CVE-2020-23172

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-10 · updated 2026-06-17
Weakness: CWE-22

Description

A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives.

Affected products

Kuba Project Kuba: all versions

References

https://github.com/kuba--/zip/issues/123
https://github.com/kuba--/zip/issues/123

Get alerted when CVE-2020-23172 or the next vulnerability affects your stack