Versions of the package zip-lib before 1.1.0 contain a Directory Traversal flaw in the caching mechanism used for path validation during extraction. The flaw allows an attacker to bypass the intended isOutsideTargetFolder check, enabling them to place extracted files outside the target directory. This can lead to arbitrary file read or write, compromising confidentiality, integrity, or availability of the system. The weakness is identified as CWE‑22.

The affected product is the npm package zip-lib, all installations using any version earlier than 1.1.0. No specific vendor name is supplied, but the library is used in Node.js applications that rely on zip file extraction.

The CVSS score of 8.7 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests that, at present, exploitation is unlikely to be widespread. Nevertheless, the flaw is not listed in the CISA KEV catalog. The likely attack vector involves an application that extracts a malicious zip archive; an attacker can supply a crafted archive that includes paths with directory traversal tokens. If the host process running the library has write permissions, the attacker can overwrite files or create files outside the intended directory.