Amazon AWS DeepJavaLibrary up to 0.31.0 ZipUtils.unzip/TarUtils.untar absolute path traversal

Summaryinfo

A vulnerability categorized as very critical has been discovered in Amazon AWS DeepJavaLibrary up to 0.31.0. The affected element is the function ZipUtils.unzip/TarUtils.untar. The manipulation results in absolute path traversal. This vulnerability is identified as CVE-2025-0851. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Amazon AWS DeepJavaLibrary up to 0.31.0. It has been classified as very critical. Affected is the function ZipUtils.unzip/TarUtils.untar. The manipulation with an unknown input leads to a absolute path traversal vulnerability. CWE is classifying the issue as CWE-36. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.

The advisory is shared for download at aws.amazon.com. This vulnerability is traded as CVE-2025-0851 since 01/29/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/15/2025). The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 0.31.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Software Library

Vendor

• Amazon

Name

• AWS DeepJavaLibrary

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12
• 0.13
• 0.14
• 0.15
• 0.16
• 0.17
• 0.18
• 0.19
• 0.20
• 0.21
• 0.22
• 0.23
• 0.24
• 0.25
• 0.26
• 0.27
• 0.28
• 0.29
• 0.30
• 0.31.0

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion