Description
Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.
Remediation
References
Related Vulnerabilities
WebLogic CVE-2022-21347 Vulnerability (CVE-2022-21347)
WordPress Plugin UserPro-Community and User Profile Privilege Escalation (4.9.20)
Oracle Database Server Other Vulnerability (CVE-2007-0269)
WordPress Plugin Affiliate Ads for Clickbank Products Cross-Site Scripting (1.6)
TCExam Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2021-20114)