CVE-2018-17297
HIGHHutool <4.1.12 - Path Traversal
Title source: llmDescription
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
Exploits (1)
nomisec
WRITEUP
by shoucheng3 · poc
https://github.com/shoucheng3/dromara__hutool_CVE-2018-17297_4-1-1111
Scores
CVSS v3
7.5
EPSS
0.0043
EPSS Percentile
62.3%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Details
CWE
CWE-22
Status
published
Products (4)
cn.hutool/hutool-all
0 - 4.1.12Maven
cn.hutool/hutool-core
0 - 4.1.12Maven
cn.hutool/hutool-parent
0 - 4.1.12Maven
hutool/hutool
< 4.1.12
Published
Sep 21, 2018
Tracked Since
Feb 18, 2026