~ / search / GHSA-23gj-368h-92pq

GHSA-23gj-368h-92pq

Path Traversal in DKPro Core

Source: GitHub Advisory Database (reviewed) High CVE-2019-11082

Packages

EcosystemPackageAffectedFixed in
Maven de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl <= 1.10.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.

References

External links from the advisory. They lead to third-party sites.