CVE-2022-0401: Path Traversal in w-zip Node.js Package

The w-zip package is a widely used Node.js library for working with ZIP archives. This Path Traversal vulnerability arises from insufficient input validation when handling file paths. An attacker can craft malicious input that bypasses security checks and allows them to access files outside of the intended directory. This could include sensitive configuration files, source code, or even system files, depending on the permissions of the running process. The potential impact is severe, as an attacker could gain access to critical system information or compromise the entire application.

1. Reserved2022-01-28
2. Published2022-02-01
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2022-0401 is to immediately upgrade the w-zip package to version 1.0.12 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter input validation on file paths within your application code. While not a complete solution, this can help reduce the attack surface. Additionally, review your application's file permissions to ensure that the Node.js process only has access to the files it absolutely needs. After upgrading, confirm the fix by attempting to access a file outside the intended directory using a crafted input – the access should be denied.