| Название | FlowCI flow-core-x v1.23.01 zipslip path traversal |
|---|
| Описание | flow-ci's `FileHelper.unzip()` extracts ZIP archives using `ZipInputStream` and constructs output paths with `Paths.get(destDir.toString(), entry.getName())`. The ZIP entry name is attacker-controlled metadata and is never sanitized. There is no `normalize()` call, no rejection of `..`, and no check that the resolved path remains inside `destDir`. A ZIP entry such as `../../../../cve03_browser_escape.txt` is therefore written outside the extraction directory.
The production trigger chain is:
1. Upload phase: An agent uploads a ZIP archive as a job report through `POST /api/flow/{name}/job/{number}/report`. The report metadata sets `zipped: true`.
2. Extraction phase:When an authenticated user requests the report through `GET /jobs/{flow}/{buildNumber}/reports/{reportId}`, `ReportServiceImpl.fetch()` passes the archive stream to `FileHelper.unzip(stream, destFile)`.
3. Path traversal: The `ZipEntry` name is joined to the destination path without validation, allowing the archive entry to escape the report extraction directory. |
|---|
| Источник | ⚠️ https://glacier-tarsal-711.notion.site/Flow-ci-ZipSlip-Path-Traversal-in-flow-ci-FileHelper-unzip-During-Job-Report-Extraction-3f7b25e24b3680a8b7cec8c15d79a2fb |
|---|
| Пользователь | Zy0t1 (UID 100983) |
|---|
| Представление | 13.10.2026 10:28 (26 дни назад) |
|---|
| Модерация | 07.11.2026 20:35 (25 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 432649 [FlowCI flow-core-x до 1.23.49 FileHelper.java FileHelper.unzip обход каталога] |
|---|
| Баллы | 17 |
|---|