Homepage

External Control of File Name or Path The advisory has been revoked - it doesn't affect any version of package gzip  (opens in a new tab)

Threat Intelligence

EPSS
5.21% (93rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL9-GZIP-11446768
  • published5 Aug 2025
  • disclosed7 Apr 2022
Report a new vulnerability Found a mistake?

Introduced: 7 Apr 2022

CVE-2022-1271  (opens in a new tab)
CWE-73  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gzip package and not the gzip package as distributed by RHEL.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.