The vulnerability identified as CVE-2024-35744 in Upunzipper is a CWE-22 path traversal issue. It occurs due to improper limitation of pathnames to restricted directories, enabling an attacker to perform unauthorized file manipulation. The affected versions include Upunzipper up to 1.0.0. The CVSS 3.1 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact is primarily on availability (denial of service). There is no vendor advisory or patch available at this time.

The vulnerability allows an attacker to traverse directories and manipulate files outside the intended extraction directory. This can lead to denial of service conditions. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when extracting archives with Upunzipper and consider alternative tools if possible.