Description
Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sitecore Experience Manager
Default version status: unaffected
9.0 to ≤ 9.3affected10.0 to ≤ 10.4affected
Sitecore Experience Platform
Default version status: unaffected
9.0 to ≤ 9.3affected10.0 to ≤ 10.4affected
Sitecore Experience Commerce
Default version status: unaffected
9.0 to ≤ 9.3affected10.0 to ≤ 10.4affected