Description
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
Remediation
References
https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py
Related Vulnerabilities
CVE-2021-23372 Vulnerability in npm package mongo-express
CVE-2022-29252 Vulnerability in maven package org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki
CVE-2020-28477 Vulnerability in maven package org.webjars.npm:immer
CVE-2021-21162 Vulnerability in maven package org.webjars.npm:electron
CVE-2019-14862 Vulnerability in maven package org.webjars.bowergithub.knockout:knockout