Exploitation Summary
EIP tracks 2 public exploits for CVE-2025-0851. PoCs published by skrkcb2, manus-use.
AI-analyzed exploit summary This repository describes a file traversal vulnerability (CVE-2025-0851) in the Deep Java Library's tar/zip extraction utility, allowing arbitrary file writes outside the intended directory during model loading. The issue arises from improper handling of absolute paths in `dest.resolve(name).toAbsolutePath()`, enabling path traversal attacks.
Description
A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
Exploits (2)
This repository describes a file traversal vulnerability (CVE-2025-0851) in the Deep Java Library's tar/zip extraction utility, allowing arbitrary file writes outside the intended directory during model loading. The issue arises from improper handling of absolute paths in `dest.resolve(name).toAbsolutePath()`, enabling path traversal attacks.
This repository contains functional exploit code for CVE-2025-32433, targeting Erlang/OTP SSH. The PoC demonstrates a pre-authentication RCE vulnerability by sending crafted SSH packets to execute arbitrary commands on the server.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H