CVE-2023-5938

highpriority · track · 0EPSS 0.007 · 52 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.67% (52nd) EPSS

CVSS 8 · high

Is it mine?

3 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nozomi_psirt

EPSS · scored 2026-10-27

Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks. An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have arbitrary files extracted to arbitrary filesystem locations. Leveraging this issue, an attacker may be able to overwrite arbitrary files on the target filesystem and cause critical impacts on the system (e.g., arbitrary command execution on the victim’s machine).

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedArcnozomi_psirt
Upgrade to v1.6.0 or later.
MitigationArcnozomi_psirt
N/A

cvss

Technical severity, 0–10. One row per scoring source.

8.9

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.9–8.9

v3.18highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · prodsec@nozominetworks.comexploitability 1.3 · impact 6

v3.18highCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:Hsecondary · Nozomi Networks PSIRT

v4.08.9highCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:Hsecondary · ENISA EU

v4.08.9highCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · prodsec@nozominetworks.com

v4.05.9mediumCVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)