{ "document": { "acknowledgments": [ { "organization": "CERT@VDE", "summary": "coordination", "urls": [ "https://certvde.com" ] } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-GB", "notes": [ { "category": "summary", "text": "Several Pilz software products do not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.", "title": "Summary" }, { "category": "description", "text": "The affected software products are using ZIP archives to save and load project backups and libraries. When loading a ZIP archive, the contained pathnames are not checked properly for relative path components. If a user loads a manipulated ZIP archive the vulnerability can be used to place potentially malicious files outside of the application's working directory. Depending on the user's privileges this can lead to code execution.", "title": "Impact" }, { "category": "description", "text": "Please visit the Pilz Shop (www.pilz.com/en-INT/eshop) to check for the fixed version", "title": "Remediation" }, { "title": "General Countermeasures", "category": "general", "text": "Do not use .zip or .par files from untrusted sources. If you need to load a file from an\nuntrusted source, please contact your local Pilz support." } ], "publisher": { "contact_details": "security@pilz.com", "name": "Pilz GmbH & Co. KG", "namespace": "https://www.pilz.com", "category": "vendor" }, "references": [ { "category": "self", "summary": "VDE-2022-044: Pilz: Multiple products affected by ZipSlip - HTML", "url": "https://certvde.com/en/advisories/VDE-2022-044/" }, { "category": "self", "summary": "VDE-2022-044: Pilz: Multiple products affected by ZipSlip - CSAF", "url": "https://pilz.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-044.json" }, { "category": "external", "summary": "Vendor PSIRT", "url": "https://www.pilz.com" }, { "category": "external", "summary": "CERT@VDE Security Advisories for Pilz GmbH & Co. KG", "url": "https://certvde.com/en/advisories/vendor/pilz/" } ], "title": "Pilz: Multiple products affected by ZipSlip", "tracking": { "aliases": [ "VDE-2022-044" ], "current_release_date": "2025-06-05T13:28:13.000Z", "generator": { "date": "2025-05-07T08:00:35.611Z", "engine": { "name": "Secvisogram", "version": "2.5.24" } }, "id": "VDE-2022-044", "initial_release_date": "2022-11-24T09:00:00.000Z", "revision_history": [ { "date": "2022-11-24T09:00:00.000Z", "number": "1", "summary": "Initial revision." }, { "number": "2", "summary": "Fix: quotation mark", "date": "2025-06-05T13:28:13.000Z" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "name": "Pilz", "category": "vendor", "branches": [ { "name": "Software", "category": "product_family", "branches": [ { "name": "PAScal", "category": "product_name", "branches": [ { "name": "<=1.9.1", "category": "product_version_range", "product": { "name": "PAScal <=1.9.1", "product_id": "CSAFPID-51001" } } ] }, { "name": "PASconnect", "category": "product_name", "branches": [ { "name": "<1.4.0", "category": "product_version_range", "product": { "name": "PASconnect <1.4.0", "product_id": "CSAFPID-51002" } } ] }, { "name": "PASmotion", "category": "product_name", "branches": [ { "name": "<1.4.1", "category": "product_version_range", "product": { "name": "PASmotion <1.4.1", "product_id": "CSAFPID-51003" } } ] }, { "name": "PNOZmulti Configurator", "category": "product_name", "branches": [ { "name": "<11.2.0", "category": "product_version_range", "product": { "name": "PNOZmulti Configurator <11.2.0", "product_id": "CSAFPID-51004" } } ] }, { "name": "PNOZmulti Configurator LTS", "category": "product_name", "branches": [ { "name": "<10.14.4", "category": "product_version_range", "product": { "name": "PNOZmulti Configurator LTS <10.14.4", "product_id": "CSAFPID-51005" } } ] } ] } ] } ], "product_groups": [ { "group_id": "CSAFGID-0001", "product_ids": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005" ], "summary": "Affected products." } ] }, "vulnerabilities": [ { "cve": "CVE-2022-40976", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "description", "text": "A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.", "title": "Vulnerability Description" } ], "product_status": { "known_affected": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005" ] }, "remediations": [ { "category": "vendor_fix", "details": "Please visit the Pilz Shop (www.pilz.com/en-INT/eshop) to check for the fixed version", "group_ids": [ "CSAFGID-0001" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "environmentalScore": 5.5, "environmentalSeverity": "MEDIUM", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "temporalScore": 5.5, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "CSAFPID-51001", "CSAFPID-51002", "CSAFPID-51003", "CSAFPID-51004", "CSAFPID-51005" ] } ], "title": "CVE-2022-40976" } ] }