CVE-2026-47862

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...

CVE-2026-47862 ZipTransformer uses file_name header to build workDirectory path without sanitization

An attacker who can set the filename header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5...

CVE-2026-47862

Spring Integration's ZipTransformer component is vulnerable to a path traversal issue when using the default ZipResultType.FILE result type. An attacker who can set the file_name message header on a message reaching the transformer can cause the resulting .zip archive to be written to an arbitrar...

cve-2026-47862 - MEDIUM - ZipTransformer uses file_name header to build workDirectory path without sanitization

cve-2026-47862 - MEDIUM - ZipTransformer uses filename header to build workDirectory path without sanitization...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via filename headers when constructing the workDirectory path. An attacker can write a .zip archive to an arbitrary filesystem location outside the intended directory by supplying crafted input. Details A Directory...

Important: Red Hat Security Advisory: Apache Camel security update

An update for the Apache Camel component that fixes one security issue is now available from the Red Hat Customer Portal for Red Hat JBoss Fuse Service Works 6.0.0. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CV...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.0.0 patch 4

Red Hat JBoss Fuse 6.0.0 patch 4, which fixes three security issues and one bug, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detail...