CVE-2022-1271
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
An arbitrary file write vulnerability in GNU gzip's zgrep utility allows an attacker to overwrite arbitrary files. When zgrep processes a crafted file name with multiple newlines, it can write selected content to any file. This is due to insufficient validation of filenames.
Risk Assessment
A remote, low-privileged attacker can force zgrep to write arbitrary files, potentially leading to system modification or privilege escalation.
Recommendation
Update GNU gzip to a patched version and avoid using zgrep on untrusted filenames.
Other vulnerabilities in GNU gzip
See all- CVE-2026-41992High
GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. By decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and trigger an out-of-bounds read in the LZH decoder.
- CVE-2026-41991Medium
GNU gzip has a vulnerability in the gzexe utility related to insecure temporary file handling. When mktemp is not available in the user's PATH, gzexe creates a temporary file with a predictable name based solely on the PID, without exclusive access or existence checks. A local attacker can pre-create this path as a symlink to an arbitrary writable file, causing a TOCTOU condition that allows arbitrary file overwrite.
Original NVD description (English source)
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS