CVE-2021-23520

The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo() on a ZipFile object.

• CWE-22

• https://github.com/juce-framework/JUCE/commit/2e874e80cba0152201aff6a4d0dc407997d10a7fPatch, Third Party Advisory
• https://snyk.io/research/zip-slip-vulnerabilityExploit, Technical Description, Third Party Advisory
• https://snyk.io/vuln/SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388607Exploit, Patch, Third Party Advisory
• https://github.com/juce-framework/JUCE/commit/2e874e80cba0152201aff6a4d0dc407997d10a7fPatch, Third Party Advisory
• https://snyk.io/research/zip-slip-vulnerabilityExploit, Technical Description, Third Party Advisory
• https://snyk.io/vuln/SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388607Exploit, Patch, Third Party Advisory

Published

Jan 31, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23507The package object-path-set before 1.0.2 are vulnerable to P…9.8
• CVE-2021-23509This affects the package json-ptr before 3.0.0. A type confu…9.8
• CVE-2021-2351Vulnerability in the Advanced Networking Option component of…8.3
• CVE-2021-23514This affects the package Crow before 0.3+4. It is possible t…7.5
• CVE-2021-23518The package cached-path-relative before 1.1.0 are vulnerable…9.8
• CVE-2021-2352Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23521This affects the package juce-framework/JUCE before 6.1.5. T…7.8
• CVE-2021-2353Vulnerability in the Siebel Core - Server Framework product …4.4
• CVE-2021-2354Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23543All versions of package realms-shim are vulnerable to Sandbo…9.8
• CVE-2021-2355Vulnerability in the Oracle Marketing product of Oracle E-Bu…9.1
• CVE-2021-23555The package vm2 before 3.9.6 are vulnerable to Sandbox Bypas…9.8