Description
Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Remediation
References
https://pivotal.io/security/cve-2018-1261
http://www.securityfocus.com/bid/104178
Related Vulnerabilities
CVE-2020-2161 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2023-37952 Vulnerability in maven package com.mabl.integration.jenkins:mabl-integration
CVE-2022-39382 Vulnerability in npm package @keystone-6/core
CVE-2023-47324 Vulnerability in maven package org.silverpeas.core:silverpeas-core
CVE-2023-22665 Vulnerability in maven package org.apache.jena:jena-arq