CVE-2021-21251

CVE-2021-21251 (OneDev) affects OneDev prior to version 4.0.3, where the KubernetesResource REST endpoint untars user‑supplied data via TarUtils (built on Apache Commons Compress). The untar process lacks checks to prevent files from traversing the filesystem and overwriting existing files, enabl...