AIKIDO-2025-10612
botbuilder-core is vulnerable to Path Traversal
71
High Risk
This Affects:
botbuilder-coreTL;DR
Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper validation of the entry.path within a zip archive before using it to construct the final extraction path. An attacker could exploit this vulnerability by crafting a malicious archive that contains a file with a relative path sequence (e.g., ../../tmp/evil.exe), which, when extracted, would traverse outside the intended outputPath directory and overwrite arbitrary files on the system, potentially leading to remote code execution.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
botbuilder-core is vulnerable to Path Traversal in versions 4.0.8 - 4.23.2.
How to fix this
Upgrade the botbuilder-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant