Description
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
Remediation
References
https://github.com/looly/hutool/issues/162
Related Vulnerabilities
CVE-2020-28052 Vulnerability in maven package bouncycastle:bcprov-jdk14
CVE-2020-5497 Vulnerability in maven package org.mitre:openid-connect-common
CVE-2022-26884 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-server
CVE-2016-5388 Vulnerability in maven package org.apache.tomcat:tomcat