CVE-2019-16511

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file (even with a ../ sequence) is concatenated with the destination path.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/GitHubAssessments/CVE_Assessments_09_2019
https://github.com/wixtoolset/issues/issues/6075Patch, Third Party Advisory
https://wixtoolset.org/development/wips/6075-dtf-zip-slip/Third Party Advisory
https://www.firegiant.com/blog/2019/9/18/wix-v3.11.2-released/Patch, Vendor Advisory
https://github.com/GitHubAssessments/CVE_Assessments_09_2019
https://github.com/wixtoolset/issues/issues/6075Patch, Third Party Advisory
https://wixtoolset.org/development/wips/6075-dtf-zip-slip/Third Party Advisory
https://www.firegiant.com/blog/2019/9/18/wix-v3.11.2-released/Patch, Vendor Advisory

Timeline

Published: Sep 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-165124.8An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modi CVE-2019-165138.8An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests.CVE-2019-165147.2An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. A CVE-2019-165156.5An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security headers are not used CVE-2019-165165.3An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability,CVE-2019-165179.8An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which re CVE-2019-165184.3An issue was discovered on Swell Kit Mod devices that use the Vandy Vape platform. An attacker may be able to trigger an unintended temperat CVE-2019-165197.8ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an undocumented feature CVE-2019-16527.2A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an au CVE-2019-165205.4The all-in-one-seo-pack plugin before 3.2.7 for WordPress (aka All in One SEO Pack) is susceptible to Stored XSS due to improper encoding of CVE-2019-165216.1The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encodi CVE-2019-165224.8The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of sev