{"document":{"acknowledgments":[{"organization":"CERT@VDE","summary":"coordination","urls":["https://certvde.com"]}],"category":"csaf_security_advisory","csaf_version":"2.0","distribution":{"tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en-GB","notes":[{"category":"summary","text":"Several Pilz software products do not properly check pathnames contained in archives. An attacker can utilise this vulnerability to write arbitrary files, potentially leading to code execution.","title":"Summary"},{"category":"description","text":"The affected software products are using ZIP archives to save and load project backups and libraries. When loading a ZIP archive, the contained pathnames are not checked properly for relative path components. If a user loads a manipulated ZIP archive the vulnerability can be used to place potentially malicious files outside of the application's working directory. Depending on the user's privileges this can lead to code execution.","title":"Impact"},{"category":"description","text":"Please visit the Pilz Shop (www.pilz.com/en-INT/eshop) to check for the fixed version","title":"Remediation"},{"category":"general","text":"Do not use .zip or .par files from untrusted sources. If you need to load a file from an\nuntrusted source, please contact your local Pilz support.","title":"General Countermeasures"}],"publisher":{"category":"vendor","contact_details":"security@pilz.com","name":"Pilz GmbH & Co. KG","namespace":"https://www.pilz.com"},"references":[{"category":"self","summary":"VDE-2022-044: Pilz: Multiple products affected by ZipSlip - HTML","url":"https://certvde.com/en/advisories/VDE-2022-044/"},{"category":"self","summary":"VDE-2022-044: Pilz: Multiple products affected by ZipSlip - CSAF","url":"https://pilz.csaf-tp.certvde.com/.well-known/csaf/white/2022/vde-2022-044.json"},{"category":"external","summary":"Vendor PSIRT","url":"https://www.pilz.com"},{"category":"external","summary":"CERT@VDE Security Advisories for Pilz GmbH & Co. KG","url":"https://certvde.com/en/advisories/vendor/pilz/"}],"title":"Pilz: Multiple products affected by ZipSlip","tracking":{"aliases":["VDE-2022-044"],"current_release_date":"2025-06-05T13:28:13.000Z","generator":{"date":"2025-05-07T08:00:35.611Z","engine":{"name":"Secvisogram","version":"2.5.24"}},"id":"VDE-2022-044","initial_release_date":"2022-11-24T09:00:00.000Z","revision_history":[{"date":"2022-11-24T09:00:00.000Z","number":"1","summary":"Initial revision."},{"date":"2025-06-05T13:28:13.000Z","number":"2","summary":"Fix: quotation mark"}],"status":"final","version":"2"}},"product_tree":{"branches":[{"branches":[{"branches":[{"branches":[{"category":"product_version_range","name":"<=1.9.1","product":{"name":"PAScal <=1.9.1","product_id":"CSAFPID-51001"}}],"category":"product_name","name":"PAScal"},{"branches":[{"category":"product_version_range","name":"<1.4.0","product":{"name":"PASconnect <1.4.0","product_id":"CSAFPID-51002"}}],"category":"product_name","name":"PASconnect"},{"branches":[{"category":"product_version_range","name":"<1.4.1","product":{"name":"PASmotion <1.4.1","product_id":"CSAFPID-51003"}}],"category":"product_name","name":"PASmotion"},{"branches":[{"category":"product_version_range","name":"<11.2.0","product":{"name":"PNOZmulti Configurator <11.2.0","product_id":"CSAFPID-51004"}}],"category":"product_name","name":"PNOZmulti Configurator"},{"branches":[{"category":"product_version_range","name":"<10.14.4","product":{"name":"PNOZmulti Configurator LTS <10.14.4","product_id":"CSAFPID-51005"}}],"category":"product_name","name":"PNOZmulti Configurator LTS"}],"category":"product_family","name":"Software"}],"category":"vendor","name":"Pilz"}],"product_groups":[{"group_id":"CSAFGID-0001","product_ids":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005"],"summary":"Affected products."}]},"vulnerabilities":[{"cve":"CVE-2022-40976","cwe":{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},"notes":[{"category":"description","text":"A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.","title":"Vulnerability Description"}],"product_status":{"known_affected":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005"]},"remediations":[{"category":"vendor_fix","details":"Please visit the Pilz Shop (www.pilz.com/en-INT/eshop) to check for the fixed version","group_ids":["CSAFGID-0001"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":5.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","environmentalScore":5.5,"environmentalSeverity":"MEDIUM","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","temporalScore":5.5,"temporalSeverity":"MEDIUM","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","version":"3.1"},"products":["CSAFPID-51001","CSAFPID-51002","CSAFPID-51003","CSAFPID-51004","CSAFPID-51005"]}],"title":"CVE-2022-40976"}]}