GHSA-2rpm-4x8c-pvqg
Improper Limitation of a Pathname to a Restricted Directory in Zip4j
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | net.lingala.zip4j:zip4j | < 1.3.3 | 1.3.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
References
External links from the advisory. They lead to third-party sites.