CVE-2023-44387

A flaw was found in Gradle. When copying files or creating archives, Gradle does not preserve symbolic links, instead resolving them to their underlying target file, but permissions of the new file use those of the link instead of those from the target file. This issue can lead to files with broader permissions than intended, as symbolic links are usually world-readable and writeable.

Mitigation

User should follow the documentation to explicitly set permissions when copying or create archives: <https://docs.gradle.org/current/userguide/working_with_files.html#sec:setting_file_permissions&gt;