CVE-2022-26049
Arbitrary File Write via Archive Extraction (Zip Slip)
- Published
- Updated
- Reserved
- Assigned by
- snyk
Description
This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability. **Note:** This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.
Timeline
ID reserved
By snyk
- 7 months later
· 7 months later
Published
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| snykCNA (assigner) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 2.5% · top 15% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
- Arbitrary File Write via Archive Extraction (Zip Slip)
- CWE-22 (opens in a new tab)All about CWE-22 and its CVEs
Affected products
com.diffplug.gradle:goomph
- affected unspecified – < 3.37.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavencom.diffplug.gradle:goomphGHSA-p2f7-9cv7-jjf6 (opens in a new tab)
References (3)
- https://security.snyk.io/vuln/SNYK-JAVA-COMDIFFPLUGGRADLE-2981040 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/diffplug/goomph/pull/198 (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/diffplug/goomph/commit/25f04f67ba62d9a14104bee13a0a0f2517afb8c8 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-p2f7-9cv7-jjf6 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-26049)Record last updated .