CVE-2022-35410

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-08 · updated 2026-06-17
Weakness: CWE-22

Description

mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.

Affected products

0Xacab Mat2: before 0.13.0 — fixed in 0.13.0
Debian Linux: 10.0, 11.0

How to fix

Upgrade to a fixed version: 0Xacab Mat2 0.13.0. Check the vendor advisory for mitigations.

References

https://0xacab.org/jvoisin/mat2/-/commit/beebca4bf1cd3b935824c966ce077e7bcf610385
https://0xacab.org/jvoisin/mat2/-/issues/174
https://dustri.org/b/mat2-0130.html
https://www.debian.org/security/2022/dsa-5185
https://0xacab.org/jvoisin/mat2/-/commit/beebca4bf1cd3b935824c966ce077e7bcf610385
https://0xacab.org/jvoisin/mat2/-/issues/174
https://dustri.org/b/mat2-0130.html
https://www.debian.org/security/2022/dsa-5185

Get alerted when CVE-2022-35410 or the next vulnerability affects your stack