Description
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
Remediation
References
https://github.com/looly/hutool/issues/162
Related Vulnerabilities
CVE-2012-0392 Vulnerability in maven package org.apache.struts.xwork:xwork-core
CVE-2019-10420 Vulnerability in maven package org.jenkins-ci.plugins:assembla
CVE-2016-8741 Vulnerability in maven package org.apache.qpid:qpid-broker-core
CVE-2022-21803 Vulnerability in npm package nconf
CVE-2020-10199 Vulnerability in maven package org.sonatype.nexus:nexus-extdirect