Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Zip Slip Path Traversal in quarkus-openapi-generator ApicurioCodegenWrapper class
Vulnerability Description
Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java extracts ZIP entries without validating that the resolved file path stays within the intended output directory. At line 101, the destination is constructed as new File(toOutputDir, entry.getName()) and the content is written immediately. A malicious ZIP archive containing entries with path traversal sequences (e.g., ../../malicious.java) would write files outside the target directory. This vulnerability is fixed in 2.16.0 and 2.15.0-lts.
CVSS Information
N/A
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
Quarkus OpenAPI Generator 路径遍历漏洞
Vulnerability Description
Quarkus OpenAPI Generator是Quarkiverse Hub开源的一个基于OpenAPI规范的代码生成工具。 Quarkus OpenAPI Generator 2.16.0之前版本和2.15.0-lts之前版本存在路径遍历漏洞，该漏洞源于ApicurioCodegenWrapper.java中的unzip()方法提取ZIP条目时未验证解析后的文件路径是否保持在预期输出目录内，可能导致路径遍历攻击。
CVSS Information
N/A
Vulnerability Type
N/A