Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability

A directory traversal vulnerability allowing remote code execution has been identified in Allegra versions prior to 8.1.2. This issue arises in the extractFileFromZip method, where user-supplied paths are not properly validated before being used in file operations. As a result, authenticated attackers can exploit this vulnerability to execute arbitrary code within the context of the current process.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Remediation

Users are advised to update to Allegra version 8.1.2 or later, where this vulnerability has been addressed.