WS-2018-0601

The example Expander class in Apache Commons Compress before 1.18 has been vulnerable to a path traversal in the edge case that happens when the target directory has a sibling directory and the name of the target directory is a prefix of the sibling directory's name...