Arbitrary File Write

org.springframework.integration, spring-integration-zip is vulnerable to arbitrary file write. The vulnerability is due to improper validation of the filename header when processing messages with ZipResultType.FILE, which allows an attacker to specify an arbitrary filesystem path and cause the...

org.eclipse.digitaltwin.basyx:basyx.aasenvironment-client (>=2.0.0-milestone-14, <=2.0.0-milestone-15), org.eclipse.digitaltwin.basyx:basyx.aasenvironment-core (>=2.0.0-milestone-14, <=2.0.0-milestone-15) +8 more potentially affected by CVE-2026-47862 via org.springframework.integration:spring-integration-file (7.1.0)

org.springframework.integration:spring-integration-file MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-59311 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-47862 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

com.farao-community.farao:gridcapa-core-cc-data-bridge (>=1.3.0, <=1.6.0), com.farao-community.farao:gridcapa-data-bridge (>=2.4.0, <=2.7.0) potentially affected by CVE-2026-59274 via org.springframework.integration:spring-integration-zip (6.5.0)

org.springframework.integration:spring-integration-zip MAVEN version 6.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-zip and may be impacted: -...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the ZipTransformer process. An attacker can overwrite or plant files in arbitrary directories by pre-creating a symbolic link at /tmp/ziptransformer before the application starts, causing extracted archive contents an...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the UnZipTransformer process. An attacker can exhaust system memory and cause service outages by submitting specially crafted zip archives with excessive decompressed...

org.springframework.integration:spring-integration-ftp (4.3.24.release), org.springframework.integration:spring-integration-sftp (4.3.24.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.24.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.24.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (4.3.22.release), org.springframework.integration:spring-integration-sftp (4.3.22.release) +1 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (4.3.22.release)

org.springframework.integration:spring-integration-file MAVEN version 4.3.22.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.integration:spring-integration-file and may be impacted: -...

org.springframework.integration:spring-integration-ftp (>=7.1.0-m1, <=7.1.0-rc1), org.springframework.integration:spring-integration-sftp (>=7.1.0-m1, <=7.1.0-rc1) +2 more potentially affected by CVE-2026-40987 via org.springframework.integration:spring-integration-file (>=7.1.0-m1, <=7.1.0-rc1)

org.springframework.integration:spring-integration-file MAVEN version =7.1.0-m1, =7.1.0-m1, =7.1.0-m1, =7.1.0-m1, =7.1.0-m1, =7.1.0-rc1 Source cves: CVE-2026-40987 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKINTEGRATION-17308053...

EUVD-2022-1556

Malicious code in bioql PyPI...

EUVD-2022-3141

Malicious code in bioql PyPI...

CVE-2021-22114

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

K23985340: Spring Integration Zip vulnerability CVE-2018-1261

Security Advisory Description Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z that holds path traversal filenames. So when the...

spring-integration-zip Arbitrary File Write

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal...

Path Traversal in Spring-integration-zip

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

com.farao-community.farao:gridcapa-data-bridge (>=1.0.0, <=1.3.2), com.pleosoft.pleodox:pleodox-core (>=1.0.0-release, <=1.0.2-release) potentially affected by CVE-2021-22114 via org.springframework.integration:spring-integration-zip (>=1.0.2.release, <=1.0.3.release)

org.springframework.integration:spring-integration-zip MAVEN version =1.0.2.release, =1.0.0, =1.0.0-release, =1.0.2-release Source cves: CVE-2021-22114 Source advisory: OSV:GHSA-VW83-H3MQ-3QWJ...

com.farao-community.farao:gridcapa-data-bridge (>=1.0.0, <=1.3.2), com.pleosoft.pleodox:pleodox-core (>=1.0.0-release, <=1.0.2-release) potentially affected by CVE-2021-22114 via org.springframework.integration:spring-integration-zip (>=1.0.2.release, <=1.0.3.release)

org.springframework.integration:spring-integration-zip MAVEN version =1.0.2.release, =1.0.0, =1.0.0-release, =1.0.2-release Source cves: CVE-2021-22114 Source advisory: GHSA-VW83-H3MQ-3QWJ...

GHSA-VW83-H3MQ-3QWJ Path Traversal in Spring-integration-zip

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive affects other archives as well, bzip2, tar, xz, war, cpio, 7z, that holds path traversal filenames. So...

Arbitrary File Rewrite

spring-integration-zip is vulnerable to an arbitrary file rewrite aka a zip slip vulnerability. An incomplete fix of CVE-2018-1263 allows an attacker to send a malicious zip archive bzip2, tar, xz, war, cpio, 7z with path traversal filenames, leading to writing of files outside of the target...