Vulnerability record · CVE-2023-22899 · published 10 January 2023

CVE-2023-22899: Zip4j project zip4j origin validation error vulnerability

ZZip4j Project · Zip4j

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

5.9 CVSS 3.1 Medium EPSS 0.62% · top 52.2% CWE-346 · Origin validation error

5.9CVSS 3.1 base score

0.62%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

12References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

ZZip4j Zip4j Project

References

Link	Tags
https://breakingthe3ma.app	Third Party Advisory
https://breakingthe3ma.app/files/Threema-PST22.pdf	ExploitTechnical DescriptionThird Party Advisory
https://github.com/srikanth-lingala/zip4j/issues/485	ExploitIssue TrackingPatchThird Party Advisory
https://github.com/srikanth-lingala/zip4j/releases	Release NotesThird Party Advisory
https://news.ycombinator.com/item?id=34316206	Third Party Advisory
https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement	Vendor Advisory
https://breakingthe3ma.app	Third Party Advisory
https://breakingthe3ma.app/files/Threema-PST22.pdf	ExploitTechnical DescriptionThird Party Advisory
https://github.com/srikanth-lingala/zip4j/issues/485	ExploitIssue TrackingPatchThird Party Advisory
https://github.com/srikanth-lingala/zip4j/releases	Release NotesThird Party Advisory
https://news.ycombinator.com/item?id=34316206	Third Party Advisory
https://threema.ch/en/blog/posts/news-alleged-weaknesses-statement	Vendor Advisory

Track CVE-2023-22899 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2018-1002202Zip4j project zip4j path traversal vulnerabilityzip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive en…EPSS 11%25 Jul 2018 5.5CVE-2022-24615Zip4j project zip4j vulnerabilityzip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. Thi…EPSS 0.71%24 Feb 2022 9.4CVE-2025-34291Langflow CORS misconfiguration leads to token theft and RCELangflow up to and including 1.6.9 ships an overly permissive CORS configuration (allow_origins='*' with allow_credentials=True) and a refresh token …KEVEPSS 93%analysed5 Dec 2025 8.8CVE-2015-4495Firefox PDF reader same-origin bypass allows file read and privilege gainThe PDF reader in Mozilla Firefox (before 39.0.3), Firefox ESR 38.x (before 38.1.1), and Firefox OS (before 2.2) fails to properly validate origin, l…KEVEPSS 69%analysed8 Aug 2015

Source: NIST National Vulnerability Database (record CVE-2023-22899), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.