Allegra isZipEntryValide Directory Traversal Remote Code Execution Vulnerability

A directory traversal vulnerability allowing remote code execution has been identified in Allegra. This issue arises from the isZipEntryValide method's improper validation of user-supplied paths before they are used in file operations. As a result, authenticated attackers can exploit this vulnerability to execute arbitrary code on the affected system, with the executed code running under the LOCAL SERVICE context.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the LOCAL SERVICE account.

Remediation

Allegra has released an update to address this vulnerability. Users can refer to the release notes for version 8.1.2 for more information.