EAP Legislator Path Traversal Vulnerability in File Extraction Functionality

A path traversal vulnerability has been identified in EAP Legislator, a popular legal document editing software by ABC PRO. This vulnerability affects all versions prior to 2.25a. It allows an attacker to create a zipx archive, the default file type for the application, and specify an arbitrary extraction path outside the intended directory. For example, files could be extracted to the system's startup folder. The issue arises when the victim opens the manipulated archive, leading to unauthorized file extraction.

Impact

Exploitation of this vulnerability could result in unauthorized file extraction to arbitrary locations on the victim's system, potentially leading to further exploitation or information disclosure.

Remediation

Users can upgrade to EAP Legislator version 2.25a or later to address this vulnerability.