deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-jx2w-vp7f-456q
Package: io.quarkiverse.openapi.generator:quarkus-openapi-generator (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 2.15.0
Patched in: 2.16.0

Summary: quarkus-openapi-generator extension has Zip Slip Path Traversal in ApicurioCodegenWrapper class

Details:
### Summary
A path traversal vulnerability was discovered in the quarkus-openapi-generator extension

### Details
The `unzip()` method in `ApicurioCodegenWrapper.java` extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as `new File(toOutputDir, entry.getName())` and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., `../../malicious.java`) would write files outside the target directory.

The interesting thing is that the client module in the same repository already has the correct fix. `OpenApiGeneratorStreamCodeGen.java` at line 137 performs proper `normalize()` and `startsWith()` validation. The server module was simply missed.

### PoC
This vulnerability is exploitable when an attacker controls or can intercept the ZIP archive served by the Apicurio registry. In environments where the registry connection is over an untrusted network or where TLS is not properly configured, exploitation becomes practical. The attack occurs at build/codegen time.

1. Create a ZIP file containing an entry named `../../proof.txt` with arbitrary content
2. Configure quarkus-openapi-generator to use the server (Apicurio) code generation path
3. Serve the malicious ZIP from a controlled or MITM'd Apicurio registry endpoint
4. Trigger code generation
5. Observe that `proof.txt` is written two directories above the intended output


### Impact
An attacker who can serve a crafted ZIP to the code generation pipeline could write arbitrary files on the build machine. This could overwrite source files, inject malicious code into the build output, or modify configuration files. In CI/CD environments, this could lead to supply chain compromise.
GitHub Security Advisory: GHSA-wmxr-6j5f-838p
Package: org.keycloak:keycloak-saml-core (MAVEN)
Severity: HIGH (CVSS 7.7)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 26.5.0, < 26.5.5
Patched in: 26.5.5

Summary: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Details:
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GitHub Security Advisory: GHSA-wmxr-6j5f-838p
Package: org.keycloak:keycloak-saml-core (MAVEN)
Severity: HIGH (CVSS 7.7)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: < 26.2.14
Patched in: 26.2.14

Summary: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Details:
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GitHub Security Advisory: GHSA-wmxr-6j5f-838p
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 7.7)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 26.3.0, < 26.4.10
Patched in: 26.4.10

Summary: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Details:
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GitHub Security Advisory: GHSA-wmxr-6j5f-838p
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 7.7)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: < 26.2.14
Patched in: 26.2.14

Summary: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Details:
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GitHub Security Advisory: GHSA-wmxr-6j5f-838p
Package: org.keycloak:keycloak-saml-adapter-core (MAVEN)
Severity: HIGH (CVSS 7.7)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 26.5.0, < 26.5.5
Patched in: 26.5.5

Summary: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Details:
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GitHub Security Advisory: GHSA-wmxr-6j5f-838p
Package: org.keycloak:keycloak-saml-adapter-core (MAVEN)
Severity: HIGH (CVSS 7.7)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 26.3.0, < 26.4.10
Patched in: 26.4.10

Summary: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Details:
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GitHub Security Advisory: GHSA-wmxr-6j5f-838p
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 7.7)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 26.5.0, < 26.5.5
Patched in: 26.5.5

Summary: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Details:
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GitHub Security Advisory: GHSA-wmxr-6j5f-838p
Package: org.keycloak:keycloak-saml-core (MAVEN)
Severity: HIGH (CVSS 7.7)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: >= 26.3.0, < 26.4.10
Patched in: 26.4.10

Summary: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Details:
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GitHub Security Advisory: GHSA-wmxr-6j5f-838p
Package: org.keycloak:keycloak-saml-adapter-core (MAVEN)
Severity: HIGH (CVSS 7.7)
CWE: CWE-1287: Improper Validation of Specified Type of Input
Vulnerable versions: < 26.2.14
Patched in: 26.2.14

Summary: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Details:
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.
GitHub Security Advisory: GHSA-h2h4-5m64-m273
Package: org.apache.activemq:activemq-web (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.0.0, < 6.2.2
Patched in: 6.2.2

Summary: Apache ActiveMQ: Improper validation and restriction of a classpath path name

Details:
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
GitHub Security Advisory: GHSA-h2h4-5m64-m273
Package: org.apache.activemq:activemq-web (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 5.19.3
Patched in: 5.19.3

Summary: Apache ActiveMQ: Improper validation and restriction of a classpath path name

Details:
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
GitHub Security Advisory: GHSA-h2h4-5m64-m273
Package: org.apache.activemq:activemq-all (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.0.0, < 6.2.2
Patched in: 6.2.2

Summary: Apache ActiveMQ: Improper validation and restriction of a classpath path name

Details:
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
GitHub Security Advisory: GHSA-h2h4-5m64-m273
Package: org.apache.activemq:activemq-all (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 5.19.3
Patched in: 5.19.3

Summary: Apache ActiveMQ: Improper validation and restriction of a classpath path name

Details:
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
GitHub Security Advisory: GHSA-h2h4-5m64-m273
Package: org.apache.activemq:activemq-broker (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.0.0, < 6.2.2
Patched in: 6.2.2

Summary: Apache ActiveMQ: Improper validation and restriction of a classpath path name

Details:
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
GitHub Security Advisory: GHSA-h2h4-5m64-m273
Package: org.apache.activemq:activemq-broker (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 5.19.3
Patched in: 5.19.3

Summary: Apache ActiveMQ: Improper validation and restriction of a classpath path name

Details:
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
GitHub Security Advisory: GHSA-h2h4-5m64-m273
Package: org.apache.activemq:activemq-client (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 6.0.0, < 6.2.2
Patched in: 6.2.2

Summary: Apache ActiveMQ: Improper validation and restriction of a classpath path name

Details:
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
GitHub Security Advisory: GHSA-h2h4-5m64-m273
Package: org.apache.activemq:activemq-client (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 5.19.3
Patched in: 5.19.3

Summary: Apache ActiveMQ: Improper validation and restriction of a classpath path name

Details:
Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ.

In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2.

Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
GitHub Security Advisory: GHSA-h259-74h5-4rh9
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 17.5.0-rc-1, < 17.10.1
Patched in: 17.10.1

Summary: XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API

Details:
### Impact
An improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users.

### Patches
The vulnerability has been patched in XWiki 17.4.8 and 17.10.1 by requiring programming right to access the affected scripting API.

### Workarounds
We're not aware of any workarounds except for being careful whom you grant script right.

### Attribution
We thank Youssef Azefzaf for discovering and reporting this vulnerability.
GitHub Security Advisory: GHSA-h259-74h5-4rh9
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.8
Patched in: 17.4.8

Summary: XWiki vulnerable to remote code execution with script right through unprotected Velocity scripting API

Details:
### Impact
An improperly protected scripting API allows any user with script right to bypass the sandboxing of the Velocity scripting API and execute, e.g., arbitrary Python scripts, allowing full access to the XWiki instance and thereby compromising the confidentiality, integrity and availability of the whole instance. Note that script right already constitutes a high level of access that we don't recommend giving to untrusted users.

### Patches
The vulnerability has been patched in XWiki 17.4.8 and 17.10.1 by requiring programming right to access the affected scripting API.

### Workarounds
We're not aware of any workarounds except for being careful whom you grant script right.

### Attribution
We thank Youssef Azefzaf for discovering and reporting this vulnerability.