Unscored CVE-2021-24035 EUVD-2021-10954GHSA-rrv8-x3gg-xhjg

A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13…

Published Jun 11, 2021 · Updated Aug 3, 2024 · Assigned by facebook

Vendor: Facebook Product: WhatsApp Business for Android Product: WhatsApp for Android Platform: Android

Description

A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.

Affected products

Vendor	Product	Affected	Fixed
Facebook	WhatsApp Business for Android	unspecified – < v2.21.8.13	v2.21.8.13
Facebook	WhatsApp for Android	unspecified – < v2.21.8.13	v2.21.8.13

References

https://www.whatsapp.com/security/advisories/2021/