CVE-2018-10860: Archive::Zip path traversal allows arbitrary file write on extraction

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityHigh CVSS (7.5) integrity impact with no authentication or interaction required and very high EPSS, though no confirmed in-the-wild exploitation is recorded.

What it is

The Perl Archive::Zip module fails to sanitize paths when extracting zip archives, allowing directory traversal entries to escape the intended extraction directory. Any application that extracts untrusted archives with this module can have files written or overwritten outside the target location.

Impact

An attacker who supplies a crafted archive can write or overwrite arbitrary files with the privileges of the Perl interpreter, potentially leading to code execution or configuration tampering depending on what files are reachable.

Attack surface

Reached remotely by delivering a malicious zip archive to a service or script that extracts it with Archive::Zip; the CVSS vector shows no authentication and no user interaction required, though real exposure depends on whether the application accepts attacker-supplied archives.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.49 (98.8th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Update perl-archive-zip to the fixed version from your distribution (Ubuntu USN-3703-1/3703-2, Debian DSA-4300) or upstream.
• Where patching is delayed, validate and reject archive entries containing absolute paths or '..' segments before extraction.
• Extract archives into a sandboxed directory with least-privilege service accounts and no write access to sensitive paths.
• Avoid extracting untrusted archives in processes running as root or with broad filesystem permissions.

Detection

• Monitor for file creation or modification outside expected extraction directories by processes using Perl Archive::Zip.
• Alert on archive entries containing '../' or absolute paths in extraction logs or pre-processing checks.
• Audit application code and dependencies for Archive::Zip extract calls handling user-supplied archives.
• Watch for unexpected writes to startup, cron, or web-accessible paths by Perl processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.