Description
Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
Remediation
References
https://github.com/outflanknl/Exploits/blob/master/harakiri-CVE-2016-1000282.py
Related Vulnerabilities
CVE-2021-23797 Vulnerability in npm package http-server-node
CVE-2007-6433 Vulnerability in maven package org.jboss.seam:jboss-seam
CVE-2020-28280 Vulnerability in npm package predefine
CVE-2023-46498 Vulnerability in npm package @evershop/evershop
CVE-2020-28278 Vulnerability in maven package org.webjars.npm:shvl