GHSA-rhq2-2574-78mc
Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | cn.hutool:hutool-parent | < 4.1.12 | 4.1.12 |
| Maven | cn.hutool:hutool-all | < 4.1.12 | 4.1.12 |
| Maven | cn.hutool:hutool-core | < 4.1.12 | 4.1.12 |
Details
As written in the advisory (Markdown source, shown as plain text).
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
References
External links from the advisory. They lead to third-party sites.