Description (CNA)
A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| AWS / DeepJavaLibrary | affected 0.1.0 before 0.31.1 |
CWE
CWE-36, CWE-73
References
- https://aws.amazon.com/security/security-bulletins/AWS-2025-003/
- https://github.com/deepjavalibrary/djl/security/advisories/GHSA-jcrp-x7w3-ffmg
- https://github.com/deepjavalibrary/djl/releases/tag/v0.31.1
ADP enrichment
No English description supplied.
No references supplied.