Description
Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Remediation
References
http://www.securityfocus.com/bid/104179
https://pivotal.io/security/cve-2018-1263
Related Vulnerabilities
CVE-2022-24433 Vulnerability in npm package simple-git
CVE-2016-10616 Vulnerability in npm package openframe-image
CVE-2018-1999024 Vulnerability in maven package org.webjars.npm:mathjax
CVE-2021-36374 Vulnerability in maven package org.apache.ant:ant
CVE-2011-4343 Vulnerability in maven package org.apache.myfaces.core:myfaces-api