| 제목 | FlowCI flow-core-x v1.23.01 zipslip path traversal |
|---|
| 설명 | flow-ci's `FileHelper.unzip()` extracts ZIP archives using `ZipInputStream` and constructs output paths with `Paths.get(destDir.toString(), entry.getName())`. The ZIP entry name is attacker-controlled metadata and is never sanitized. There is no `normalize()` call, no rejection of `..`, and no check that the resolved path remains inside `destDir`. A ZIP entry such as `../../../../cve03_browser_escape.txt` is therefore written outside the extraction directory.
The production trigger chain is:
1. Upload phase: An agent uploads a ZIP archive as a job report through `POST /api/flow/{name}/job/{number}/report`. The report metadata sets `zipped: true`.
2. Extraction phase:When an authenticated user requests the report through `GET /jobs/{flow}/{buildNumber}/reports/{reportId}`, `ReportServiceImpl.fetch()` passes the archive stream to `FileHelper.unzip(stream, destFile)`.
3. Path traversal: The `ZipEntry` name is joined to the destination path without validation, allowing the archive entry to escape the report extraction directory. |
|---|
| 원천 | ⚠️ https://glacier-tarsal-711.notion.site/Flow-ci-ZipSlip-Path-Traversal-in-flow-ci-FileHelper-unzip-During-Job-Report-Extraction-3f7b25e24b3680a8b7cec8c15d79a2fb |
|---|
| 사용자 | Zy0t1 (UID 100983) |
|---|
| 제출 | 2026. 10. 13. AM 10:28 (26 날 ago) |
|---|
| 모더레이션 | 2026. 11. 07. PM 08:35 (25 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 432649 [FlowCI flow-core-x 까지 1.23.49 FileHelper.java FileHelper.unzip 디렉토리 순회] |
|---|
| 포인트들 | 17 |
|---|