Read the docs
TI-2022-19517 Aliases CVE-2022-40976GHSA-g8jg-vfp7-h8mr

PILZ: Multiple products affected by ZipSlip

Priority LOW 24CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to trigger arbitrary file writes ('zip-slip'). File writes do not affect confidentiality or availability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0023 13th percentileScored 2026-11-07
Fix Fixed PASconnect (PILZ): 1.4.0PASmotion (PILZ): 1.4.1+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PilzPAScal1.0.0 – 1.9.1—No fix listedCNA
PilzPASconnect1.0.0 to before 1.4.01.4.0Patch availableCNA
PilzPASmotion1.0.0 to before 1.4.11.4.1Patch availableCNA
PilzPNOZmulti Configurator1.0.0 to before 11.2.011.2.0Patch availableCNA
PilzPNOZmulti Configurator LTS1.0.0 to before 10.14.410.14.4Patch availableCNA
PilzPAS40001.0.0 to before 1.25.01.25.0Patch availableCNA
  • PAScal VendorPilz Affected 1.0.0 – 1.9.1 Fixed in — No fix listed CNA
  • PASconnect VendorPilz Affected 1.0.0 to before 1.4.0 Fixed in 1.4.0 Patch available CNA
  • PASmotion VendorPilz Affected 1.0.0 to before 1.4.1 Fixed in 1.4.1 Patch available CNA
  • PNOZmulti Configurator VendorPilz Affected 1.0.0 to before 11.2.0 Fixed in 11.2.0 Patch available CNA
  • PNOZmulti Configurator LTS VendorPilz Affected 1.0.0 to before 10.14.4 Fixed in 10.14.4 Patch available CNA
  • PAS4000 VendorPilz Affected 1.0.0 to before 1.25.0 Fixed in 1.25.0 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:o:pilz:pas_4000:*:*:*:*:*:*:*:*before 1.25.0VulnerablePilz
cpe:2.3:h:pilz:pss_4000:-:*:*:*:*:*:*:*not specified by NVDRunning onPilz
cpe:2.3:a:pliz:pascal:*:*:*:*:*:*:*:*up to 1.9.1VulnerablePliz
cpe:2.3:a:pliz:pasconnect:*:*:*:*:*:*:*:*before 1.4.0VulnerablePliz
cpe:2.3:a:pliz:pasmotion:*:*:*:*:*:*:*:*before 1.4.1VulnerablePliz
cpe:2.3:a:pliz:pnozmulti_configurator:*:*:*:*:long_term_support:*:*:*before 10.14.4VulnerablePliz
cpe:2.3:a:pliz:pnozmulti_configurator:*:*:*:*:-:*:*:*before 11.2.0VulnerablePliz
  • cpe:2.3:o:pilz:pas_4000:*:*:*:*:*:*:*:* Versions before 1.25.0 Vulnerable ·Pilz
  • cpe:2.3:h:pilz:pss_4000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Pilz
  • cpe:2.3:a:pliz:pascal:*:*:*:*:*:*:*:* Versions up to 1.9.1 Vulnerable ·Pliz
  • cpe:2.3:a:pliz:pasconnect:*:*:*:*:*:*:*:* Versions before 1.4.0 Vulnerable ·Pliz
  • cpe:2.3:a:pliz:pasmotion:*:*:*:*:*:*:*:* Versions before 1.4.1 Vulnerable ·Pliz
  • cpe:2.3:a:pliz:pnozmulti_configurator:*:*:*:*:long_term_support:*:*:* Versions before 10.14.4 Vulnerable ·Pliz
  • cpe:2.3:a:pliz:pnozmulti_configurator:*:*:*:*:-:*:*:* Versions before 11.2.0 Vulnerable ·Pliz

Remediation

  • Fix · CNA PASconnect (PILZ) Fixed in 1.4.0
  • Fix · CNA PASmotion (PILZ) Fixed in 1.4.1
  • Fix · CNA PNOZmulti Configurator (PILZ) Fixed in 11.2.0
  • Fix · CNA PNOZmulti Configurator LTS (PILZ) Fixed in 10.14.4
  • Fix · CNA PAS4000 (PILZ) Fixed in 1.25.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-40976
  2. 2026-10-03 Alias added: GHSA-g8jg-vfp7-h8mr

References

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences