Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.

Vulnerability ID: GHSA-rhq2-2574-78mc
Aliases: CVE-2018-17297
Published: 2018-10-17 19:54:53
CWE: CWE-22
Severity rating: HIGH
CVSS: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven
name: cn.hutool:hutool-parent
package: ecosystem: Maven
name: cn.hutool:hutool-all
package: ecosystem: Maven
name: cn.hutool:hutool-core