CVE-2022-35410

What it actually does

Directory traversal flaw in ZIP archive processing permits crafted archives containing ../ sequences to read files outside the intended extraction or cleaning directory during metadata removal.

Why it matters to the business

Web-facing instances of the metadata tool may leak sensitive configuration, source, or user files to remote attackers, increasing risk of data exposure on long-running deployments that have not updated in over four years.

How an attack unfolds

An attacker crafts a ZIP archive embedding relative paths that traverse upward, uploads it to a web instance performing mat2 cleaning, and receives the contents of targeted files such as configuration or secrets in the response.

How to fix it

Upgrade jvoisin/mat2 to commit eec5c33a6b1d068d91d9e7a26ae5d4a715fe990b or later and pyload/pyload to commit a9098bdf7406e6faf9df3da6ff2d584e90c13bbb or later; disable web upload features until patched.

How to confirm the fix worked

Confirm deployed version contains the listed commits; attempt upload of a test ZIP containing ../ sequences and verify that traversal is rejected and no external files are returned.

Typical attack path

1. Identify publicly reachable mat2 web endpoint or pyload instance accepting archive uploads
2. Construct ZIP containing files with ../ traversal sequences pointing to sensitive paths
3. Submit the archive through the normal upload/cleaning workflow
4. Receive file contents leaked in the processed output or error responses

How to detect it

Review web server access and application logs for ZIP uploads or processing events containing relative path sequences; inspect outbound responses that include unexpected file contents after archive handling.

• ../
• mat2.*zip
• archive.*clean

What your security team should do

• Immediately update all instances to the fixed commits listed in remediation guidance
• Restrict or disable public web upload endpoints for mat2 until patching is complete
• Scan historical logs for archive uploads containing ../ patterns to identify prior access attempts