Description
Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Remediation
References
https://tanzu.vmware.com/security/cve-2021-22114
Related Vulnerabilities
CVE-2019-1003037 Vulnerability in maven package org.jenkins-ci.plugins:azure-vm-agents
CVE-2015-0201 Vulnerability in maven package org.springframework:spring-websocket
CVE-2017-7536 Vulnerability in maven package org.hibernate:hibernate-validator
CVE-2023-20861 Vulnerability in maven package org.springframework:spring-expression
CVE-2018-11775 Vulnerability in maven package org.apache.activemq:activemq-broker