A zip slip vulnerability in Google Web Designer allows an attacker to create a specially crafted zip file that, when extracted by the application, causes files outside the intended extraction directory to be overwritten. This flaw leads to arbitrary file write and can enable privilege escalation if the application runs with elevated privileges. The weakness is a typical path traversal issue, identified as CWE‑22.

The affectation is scoped to Google Web Designer, specifically version 14.2.2.0 as indicated by the CPE string. No other releases are explicitly mentioned in the CVE data; therefore, only this version is confirmed as vulnerable.

The reported CVSS score of 8.4 signals high severity, whereas the EPSS score of less than 1% denotes a very low probability of exploitation at present. The vulnerability is not cataloged in CISA KEV. Based on the description, it is inferred that an attacker must provide a maliciously crafted zip file via the application's Import or Open function. When the user or the system extracts that file, the path traversal entry writes to arbitrary locations, provided that the executing context has write permission to those paths. No authentication or network exploitation prerequisites are stated, so the attack is likely local and independent of user credentials.