Product:
Google Web Designer
Summary
There is a zip slip vulnerability in Google Web Designer that allows for arbitrary file write and potential privilege escalation. This vulnerability can be exploited by manipulating zip file paths to write files outside of intended directories. It poses a significant risk due to its high severity rating.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2026-3223 |
Exploitation
To exploit this vulnerability, an attacker must create a specially crafted zip file that contains malicious file paths. When this zip file is processed by Google Web Designer, it can lead to files being written to unauthorized locations on the system. This can result in privilege escalation if the attacker can execute code or commands in the context of the affected application.
Affected Products
- Google Web Designer: A web design tool that allows users to create responsive websites visually.
Mitigation
To mitigate this vulnerability, users should ensure they are using the latest version of Google Web Designer and apply any available security patches. Additionally, users should avoid opening untrusted zip files and consider implementing file system access controls to limit the impact of potential exploitation.