vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-4878

JATOS ZIP ZipUtil.java ZipUtil path traversal

MEDIUM
5.3
CVSS Score
Published: January 6, 2023 at 09:30 AM UTC
Updated: June 17, 2026 at 05:22 AM UTC
1 product affected across 1 vendorJatos

Using JATOS by N/A?

Get instant alerts when new vulnerabilities affect JATOS - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.3
Exploit prediction
EPSS 0.7%

Description

A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The name of the patch is 2b42519f309d8164e8811392770ce604cdabb5da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217548.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Jatos· Jatos
95%
v ≤ 3.7.5

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (4)

PatchThird Party Advisory
Source: [email protected]
https://github.com/JATOS/JATOS/commit/2b42519f309d8164e8811392770ce604cdabb5da
PatchRelease NotesThird Party Advisory
Source: [email protected]
https://github.com/JATOS/JATOS/releases/tag/v3.7.5-alpha
SignaturePermissions RequiredThird Party Advisory
Source: [email protected]
https://vuldb.com/?ctiid.217548
VDB EntryTechnical DescriptionThird Party Advisory
Source: [email protected]
https://vuldb.com/?id.217548

CVSS

5.3MEDIUM[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-22

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card