{"id":"GHSA-jm67-jh3g-cg3f","aliases":["BIT-joomla-2022-23793","CVE-2022-23793"],"title":"Path Traversal within joomla/archive tar class","description":"An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.","severity":"high","score":7.5,"published":"2022-03-31T00:00:16.000Z","modified":"2025-04-03T15:26:51.299Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"joomla/archive","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.1.12"}],"type":"ECOSYSTEM"}],"versions":["1.0","1.0-alpha","1.0-beta","1.0-beta2","1.0-beta3","1.1.0","1.1.1","1.1.10","1.1.11","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9"],"fixed":["1.1.12"]},{"ecosystem":"Packagist","name":"joomla/archive","ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.0.1"}],"type":"ECOSYSTEM"}],"versions":["2.0.0"],"fixed":["2.0.1"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-23793","https://developer.joomla.org/security-centre/870-20220301-core-zip-slip-within-the-tar-extractor.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/joomla/archive/CVE-2022-23793.yaml","https://github.com/joomla-framework/archive","http://packetstormsecurity.com/files/166546/Joomla-4.1.0-Zip-Slip-File-Overwrite-Path-Traversal.html"],"sources":[{"name":"OSV","id":"GHSA-jm67-jh3g-cg3f","modified":"2025-04-03T15:26:51.299801Z","url":"https://osv.dev/vulnerability/GHSA-jm67-jh3g-cg3f"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5}]}