| Titre | FlowCI flow-core-x v1.23.01 zipslip path traversal |
|---|
| Description | flow-ci's `FileHelper.unzip()` extracts ZIP archives using `ZipInputStream` and constructs output paths with `Paths.get(destDir.toString(), entry.getName())`. The ZIP entry name is attacker-controlled metadata and is never sanitized. There is no `normalize()` call, no rejection of `..`, and no check that the resolved path remains inside `destDir`. A ZIP entry such as `../../../../cve03_browser_escape.txt` is therefore written outside the extraction directory.
The production trigger chain is:
1. Upload phase: An agent uploads a ZIP archive as a job report through `POST /api/flow/{name}/job/{number}/report`. The report metadata sets `zipped: true`.
2. Extraction phase:When an authenticated user requests the report through `GET /jobs/{flow}/{buildNumber}/reports/{reportId}`, `ReportServiceImpl.fetch()` passes the archive stream to `FileHelper.unzip(stream, destFile)`.
3. Path traversal: The `ZipEntry` name is joined to the destination path without validation, allowing the archive entry to escape the report extraction directory. |
|---|
| La source | ⚠️ https://glacier-tarsal-711.notion.site/Flow-ci-ZipSlip-Path-Traversal-in-flow-ci-FileHelper-unzip-During-Job-Report-Extraction-3f7b25e24b3680a8b7cec8c15d79a2fb |
|---|
| Utilisateur | Zy0t1 (UID 100983) |
|---|
| Soumission | 13/10/2026 10:28 (il y a 26 jours) |
|---|
| Modérer | 07/11/2026 20:35 (25 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 432649 [FlowCI flow-core-x jusqu’à 1.23.49 FileHelper.java FileHelper.unzip directory traversal] |
|---|
| Points | 17 |
|---|