Critical
Security advisory
The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo() on a ZipFile object.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-23520
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:44 UTC · Revision 1
Source evidence
The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo() on a ZipFile object.
osv:CVE-2021-23520
Complete source record
{
"id": "a14ac0d4e48ccf18250900529a40ea8824abf0b81b8bd90b739da6a395f56945",
"url": "https://osv.dev/vulnerability/CVE-2021-23520",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-23520",
"summary": "The package juce-framework/juce before 6.1.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the ZipFile::uncompressEntry function in juce_ZipFile.cpp. This vulnerability is triggered when the archive is extracted upon calling uncompressTo() on a ZipFile object.",
"evidence": "osv:CVE-2021-23520",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2021-23520",
"aliases": [
"CVE-2021-23520",
"SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388607"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/juce-framework/juce",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0abbba3b18c3263137eeaeaa11c917a3425ce585"
},
{
"fixed": "2e874e80cba0152201aff6a4d0dc407997d10a7f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:juce:juce:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "6.1.5"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "2e874e80cba0152201aff6a4d0dc407997d10a7f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"6.1.4",
"6.1.3",
"6.1.2",
"6.1.1",
"6.1.0",
"6.0.8",
"6.0.7",
"6.0.6",
"6.0.5",
"6.0.4",
"6.0.3",
"6.0.1",
"6.0.0",
"5.4.7",
"5.4.6",
"5.4.5",
"5.4.4",
"5.4.3",
"5.4.2",
"5.4.1",
"5.4.0",
"5.3.2",
"5.3.1",
"5.3.0",
"5.2.1",
"5.2.0",
"5.1.2",
"4.2.3",
"4.2.2",
"4.2.1",
"4.2.0",
"4.1.0",
"4.0.3",
"4.0.2",
"4.0.1",
"3.2.0",
"3.1.1",
"3.1.0",
"3.0.8",
"3.0.7",
"3.0.6",
"3.0.5",
"3.0.4",
"3.0.3",
"3.0.2",
"3.0.1",
"3.0.0",
"2.1.8",
"2.1.7",
"2.1.6",
"2.1.5",
"2.1.4",
"2.1.3",
"2.1.2",
"2.1.1",
"2.0.41",
"2.0.40",
"2.0.39",
"2.0.38",
"2.0.37",
"2.0.36",
"2.0.35",
"2.0.34",
"2.0.33",
"2.0.32",
"2.0.31",
"2.0.0",
"1.53",
"1.52",
"1.51"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23520.json",
"vanir_signatures": [
{
"id": "CVE-2021-23520-070bd10a",
"digest": {
"length": 1638,
"function_hash": "237126485219913127008369546197861784848"
},
"source": "https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f",
"target": {
"file": "modules/juce_core/zip/juce_ZipFile.cpp",
"function": "ZipFile::uncompressEntry"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-23520-1095d741",
"digest": {
"threshold": 0.9,
"line_hashes": [
"5665146828299311367131662985033393450",
"25705000018203975215230337355470258086",
"73461143352547144272351347185771427613",
"115105954260795451183459975315968406532",
"217244814178410470630742754195289869085",
"49084122028900548364993653296666858656",
"325991889492344124971183810307317007165",
"158767576336443612894225993343742284546",
"22882037744203086060580223086712743160",
"160593107989657383839657597257657288969",
"213451794356186389434614993281912298275",
"275721802318761377509861022008396111938",
"130653500459608639864472418804361048119",
"273332470345476517697735639630909816461",
"260462639253294651763368097174421627806",
"6020749457238924465845084673732165903",
"153320649057292567536622638828076027496",
"98871360293217199458224139798961620166",
"272885099627383471393744008177406840849",
"291575883478327668516045068826351348135",
"154979891626412947699061347020712952638",
"243963904254869942640995047314810898673",
"212840248489521459102842670956752041279",
"240427392179117427293706750928373018906",
"230474873361751680400794394115815013594",
"276369141589697939840954213595942450097",
"219947248126034986284379597760536714776",
"108809999214475554462129177081981798315",
"131708057395091255140995409953012566600",
"329777542193465666182838795792419497232",
"201901353281578892610176125317185222332",
"230657091421927173177949777420568947926",
"91325379333541385178968899147732598831",
"292963932828446528557640935761250622341",
"13828876792834701556718117794312153713"
]
},
"source": "https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f",
"target": {
"file": "modules/juce_core/zip/juce_ZipFile.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-23520-15d35dc1",
"digest": {
"length": 190,
"function_hash": "330644850256258962130216906016415763780"
},
"source": "https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f",
"target": {
"file": "modules/juce_core/files/juce_TemporaryFile.cpp",
"function": "TemporaryFile::deleteTemporaryFile"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-23520-27aa51cf",
"digest": {
"threshold": 0.9,
"line_hashes": [
"252897070295914309755168594136393890767",
"330559751373960295323334258514495532823",
"18584094889909008286008261321626697420",
"94101849635669944803066779025124826108"
]
},
"source": "https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f",
"target": {
"file": "modules/juce_core/files/juce_TemporaryFile.cpp"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-23520-583241be",
"digest": {
"threshold": 0.9,
"line_hashes": [
"313450786087896710849658816888521303545",
"158873883966962821624702911924557038862",
"198250517587726303670391863374999802557"
]
},
"source": "https://github.com/juce-framework/juce/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f",
"target": {
"file": "modules/juce_core/zip/juce_ZipFile.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:24:30Z"
}
}
],
"modified": "2026-10-20T14:24:30.566792094Z",
"provider": "osv",
"references": [
"https://github.com/juce-framework/JUCE/commit/2e874e80cba0152201aff6a4d0dc407997d10a7f",
"https://snyk.io/vuln/SNYK-UNMANAGED-JUCEFRAMEWORKJUCE-2388607",
"https://snyk.io/research/zip-slip-vulnerability"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-23520",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388923,
"published_at": "2022-01-31T11:15:07.82+00:00"
}