CVE-2018-1002200

Think of an archive (like a ZIP) as a box of files. This bug can trick the extraction process into placing files “above” the intended folder, like slipping something into a neighbor’s apartment by moving through the hallway walls. If you extract archives from untrusted sources, the attacker can potentially overwrite files they shouldn’t be able to touch.

This matters if your software stack uses plexus-archiver (org.codehaus.plexus:plexus-archiver) and you extract archives as part of your business workflow. You’re most exposed when you process archives that come from customers, the internet, or any other untrusted source.

The risk is only relevant when a crafted archive is provided to (and extracted by) a vulnerable plexus-archiver version before 3.6.0.

This is AMBER because there is public proof-of-concept code and interest is rising, meaning it’s more likely to be attempted. There’s no indication it’s listed in CISA KEV, but the flaw can enable arbitrary file overwrite during extraction if untrusted archives are handled on vulnerable versions.

Act by upgrading plexus-archiver to 3.6.0 if your application extracts untrusted archives.

Confirm exposure

• Locate where plexus-archiver is used in your apps/services (direct dependency on plexus-archiver / org.codehaus.plexus:plexus-archiver, or transitive dependency in your build).
• Record the exact plexus-archiver version currently deployed.
• Check all environments where extraction happens (production, staging if it mirrors prod, and any background workers).

Identify vulnerable vs fixed versions

• Vulnerable: plexus-archiver before 3.6.0.
• Fixed: plexus-archiver 3.6.0 (also applies to org.codehaus.plexus:plexus-archiver >= 3.6.0).

Upgrade path

• Update your dependency management so builds pull plexus-archiver 3.6.0.
• Rebuild and redeploy so the runtime artifacts (jars/containers) actually include the fixed library.
• If the library is bundled inside a larger application or application server, ensure the bundle is updated (not just the build files).

Temporary workaround (if patching is delayed)

• Do not extract archives from untrusted sources until you’re on 3.6.0.
• If you must handle uploads, only accept archives from trusted internal systems/users while you upgrade.
• Where possible, configure your workflow to validate or quarantine uploaded archives before extraction (the key goal is preventing attacker-controlled archives from reaching the extractor).

What to monitor after upgrade

• Confirm the deployed version is 3.6.0 (and not an older transitive copy).
• Review logs/alerts around archive upload and extraction flows for unexpected archive handling attempts.

CISA due date

• Not provided in the findings (not listed in CISA KEV).

Severity is described as medium (CVSS 5.5) with a weakness of CWE-22 (directory traversal). The mechanism is “Zip-Slip”: archive entries containing “../” path segments can be mishandled during extraction, leading to writing outside the intended directory. Findings indicate a public PoC exists (GitHub) and exploitation is not confirmed via CISA KEV.

Exploit maturity: PoC available (public weaponization), with no KEV confirmation.

EPSS is reported as predicted 13.2% with a rising trend, but this should not be treated as confirmation of real-world exploitation.

Reachability note from the CVE description: risk depends on whether attacker-controlled archives can reach and be extracted by plexus-archiver versions before 3.6.0 (i.e., untrusted archive extraction in your workflow).