{"id":"GHSA-vgwr-773q-7j3c","aliases":["BIT-joomla-2021-26028","CVE-2021-26028"],"title":"Path Traversal within joomla/archive zip class","description":"An issue was discovered in Joomla! 3.0.0 through 3.9.24. Extracting an specifilcy crafted zip package could write files outside of the intended path.","severity":"medium","score":null,"published":"2021-03-24T17:58:13.000Z","modified":"2025-04-03T15:26:49.778Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"joomla/archive","ranges":[{"events":[{"introduced":"0"},{"fixed":"1.1.10"}],"type":"ECOSYSTEM"}],"versions":["1.0","1.0-alpha","1.0-beta","1.0-beta2","1.0-beta3","1.1.0","1.1.1","1.1.2","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8","1.1.9"],"fixed":["1.1.10"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-26028","https://github.com/joomla-framework/archive/commit/32c9009a1020d16bc1060c0d06339898b697cf2c","https://developer.joomla.org/security-centre/848-20210308-core-path-traversal-within-joomla-archive-zip-class.html","https://github.com/FriendsOfPHP/security-advisories/blob/master/joomla/archive/CVE-2021-26028.yaml"],"sources":[{"name":"OSV","id":"GHSA-vgwr-773q-7j3c","modified":"2025-04-03T15:26:49.778732Z","url":"https://osv.dev/vulnerability/GHSA-vgwr-773q-7j3c"}],"assessments":[]}