ZIP path traversal
A file inside a ZIP carries its own path, like ../../.bashrc.
Why does it matter?
A tool that unpacks the archive can overwrite files outside its folder. This is CWE-22.
What does preslice check?
Every file name in the archive. It fails on:
| Name | Example |
|---|---|
A .. folder |
../../.bashrc |
| An absolute path or a drive letter | /etc/passwd, C:/Windows/evil.txt |
| A NUL character | model.png\0.exe |
| The same name twice, in any letter case | 3D/3dmodel.model and 3D/3DModel.model |
A name like v1..2.txt passes: the dots are part of the name, not a folder.
What does a fail mean?
The archive tries to write outside its folder, or hides one file behind another of the same name. preslice never unpacks to disk, but other tools might, and a reader that keeps the second copy sees a different file.
Which apps did it work on?
Bambu Studio. A member under Auxiliaries/ named with fullwidth dots and
slashes, ．．／, passed the check for .. and then became ../ on a Windows
system using code page 1252, so it could write outside the project folder.
Commit 0067891f28
fixed it, after
fb82df48f4
closed the plain ../ case. No CVE was issued.
Are current slicers exposed?
Bambu Studio and OrcaSlicer unpack the files under Auxiliaries/ to disk, so
they are the ones that check. Bambu Studio 2.8.4 skips any name holding /../
(bbs_3mf.cpp)
and drops the fullwidth form after encoding
(line 721).
OrcaSlicer 2.4.2 skips names that hold ..
(bbs_3mf.cpp).
PrusaSlicer reads every member into memory and writes none to disk.
What do I do when the check fails?
Do not unpack the file with an unzip tool, and do not open it in an old Bambu
Studio. Read the failing name in the result: no slicer writes .., a drive letter or
a repeated name into an archive. Delete the file and tell whoever shared it.