5 matches found
GHSA-RR8V-FXXF-C986 Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
Summary ShadowCopyAction in the Shadow plugin does not validate or sanitize ZIP entry names before writing them to the output fat JAR. A malicious upstream dependency containing path traversal sequences e.g. ../../../../tmp/pwned.txt in entry names will have those entries reproduced verbatim in t...
Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
Summary ShadowCopyAction in the Shadow plugin does not validate or sanitize ZIP entry names before writing them to the output fat JAR. A malicious upstream dependency containing path traversal sequences e.g. ../../../../tmp/pwned.txt in entry names will have those entries reproduced verbatim in t...
CVE-2026-75598 Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserv...
CVE-2026-75598 Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserv...
CVE-2026-75598 Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserv...