Description
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
Remediation
References
https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py
Related Vulnerabilities
CVE-2022-21192 Vulnerability in npm package serve-lite
CVE-2022-38900 Vulnerability in npm package decode-uri-component
CVE-2022-45394 Vulnerability in maven package org.jenkins-ci.plugins:delete-log-plugin
CVE-2019-12041 Vulnerability in maven package org.webjars.bower:remarkable
CVE-2023-50730 Vulnerability in maven package org.typelevel:grackle-core_3