CVE-2025-11569: cross-zip is vulnerable to Directory Traversal through selective use of zip/unzip operations

The vulnerability in cross-zip is a classic directory traversal issue. The root cause is a complete lack of input validation on the paths provided to the zip and unzip functions. The exploit demonstrated in the proof-of-concept (PoC) involves a two-step process:

1. Arbitrary File Zipping: An attacker calls zipSync or zip with a path to a sensitive file on the server (e.g., /etc/passwd). The library does not check if this path is within the project's intended directory and proceeds to create a zip archive containing the sensitive file.

2. Arbitrary File Extraction: The attacker then calls unzipSync or unzip to extract the newly created zip file. The contents (the sensitive file) are extracted into a directory that the attacker can then access, for example, a public web directory or a temporary folder from which they can read the file.

The vulnerable functions are zip, zipSync, unzip, and unzipSync. Both the synchronous and asynchronous versions of these functions are vulnerable because they use the underlying child_process module to execute system commands (zip and unzip or PowerShell equivalents on Windows) without sanitizing the input paths. This allows an attacker to read arbitrary files from the filesystem where the application is running.