Description
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
Remediation
References
https://github.com/looly/hutool/issues/162
Related Vulnerabilities
CVE-2020-17479 Vulnerability in npm package jpv
CVE-2019-11808 Vulnerability in maven package io.ratpack:ratpack-session
CVE-2018-1324 Vulnerability in maven package org.apache.commons:commons-compress
CVE-2016-7051 Vulnerability in maven package com.fasterxml.jackson.dataformat:jackson-dataformat-xml