CVE-2024-37902 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-22 (Path Traversal). 🐛 **Flaw**: The library fails to sanitize archive entries. It allows absolute paths, enabling direct insertion into the system filesystem instead of the intended sandbox.

Q: Who is affected? (Versions/Components)

👥 **Vendor**: Deep Java Library (djl). 📦 **Affected**: Versions **0.1.0** up to **0.27.0**. 🚫 **Fixed**: Version 0.28.0 and later are safe.

Q: What can hackers do? (Privileges/Data)

💻 **Privileges**: Runs with the user's privileges. 📂 **Data**: Can overwrite critical system files. 🧨 **Result**: Remote Code Execution (RCE) potential, service disruption, or data theft via file manipulation.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Auth**: None required (PR:N). 🌐 **Network**: Remote (AV:N). 🎯 **UI**: None required (UI:N). 📉 **Complexity**: Low (AC:L). **Verdict**: Extremely easy to exploit remotely.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🕵️ **Public Exp**: No specific PoC code provided in data. 📢 **Status**: Publicly disclosed via GitHub Advisory. ⚠️ **Risk**: High likelihood of wild exploitation due to low barrier to entry.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Scan for `djl` dependency versions < 0.28.0. 📋 **Audit**: Review code for loading archives from untrusted sources. 🛠️ **Tool**: Use SAST/DAST tools detecting CWE-22 in Java archive handling.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes! Upgrade to **v0.28.0**. 🔗 **Source**: [GitHub Release](https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0). 🛡️ **Action**: Immediate patching recommended.

Q: Is it urgent? (Priority Suggestion)

🔥 **Priority**: CRITICAL (P1). 🚀 **Urgency**: Immediate action required. 📢 **Reason**: Remote, unauthenticated, low-complexity exploit with severe impact. Patch now!

Updated May 08, 2026 CVSS 10.0 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Path Traversal in Deep Java Library (DJI). 📉 **Consequences**: Attackers can overwrite system files by inserting absolute path archives. 💥 **Impact**: High severity (CVSS 9.8).…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-22 (Path Traversal). 🐛 **Flaw**: The library fails to sanitize archive entries. It allows absolute paths, enabling direct insertion into the system filesystem instead of the intended sandbox.

Q3Who is affected? (Versions/Components)

👥 **Vendor**: Deep Java Library (djl). 📦 **Affected**: Versions **0.1.0** up to **0.27.0**. 🚫 **Fixed**: Version 0.28.0 and later are safe.

Q4What can hackers do? (Privileges/Data)

💻 **Privileges**: Runs with the user's privileges. 📂 **Data**: Can overwrite critical system files. 🧨 **Result**: Remote Code Execution (RCE) potential, service disruption, or data theft via file manipulation.

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Auth**: None required (PR:N). 🌐 **Network**: Remote (AV:N). 🎯 **UI**: None required (UI:N). 📉 **Complexity**: Low (AC:L). **Verdict**: Extremely easy to exploit remotely.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🕵️ **Public Exp**: No specific PoC code provided in data. 📢 **Status**: Publicly disclosed via GitHub Advisory. ⚠️ **Risk**: High likelihood of wild exploitation due to low barrier to entry.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for `djl` dependency versions < 0.28.0. 📋 **Audit**: Review code for loading archives from untrusted sources. 🛠️ **Tool**: Use SAST/DAST tools detecting CWE-22 in Java archive handling.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes! Upgrade to **v0.28.0**. 🔗 **Source**: [GitHub Release](https://github.com/deepjavalibrary/djl/releases/tag/v0.28.0). 🛡️ **Action**: Immediate patching recommended.

Q9What if no patch? (Workaround)

🚧 **Workaround**: If upgrade impossible, **do not** load archives from untrusted sources. 🧹 **Validate**: Manually sanitize archive entry names before extraction.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority**: CRITICAL (P1). 🚀 **Urgency**: Immediate action required. 📢 **Reason**: Remote, unauthenticated, low-complexity exploit with severe impact. Patch now!

Continue exploring

Vulnerability detail Full AI analysis (login) deepjavalibrary CWE-22