| 标题 | FlowCI flow-core-x v1.23.01 zipslip path traversal |
|---|
| 描述 | flow-ci's `FileHelper.unzip()` extracts ZIP archives using `ZipInputStream` and constructs output paths with `Paths.get(destDir.toString(), entry.getName())`. The ZIP entry name is attacker-controlled metadata and is never sanitized. There is no `normalize()` call, no rejection of `..`, and no check that the resolved path remains inside `destDir`. A ZIP entry such as `../../../../cve03_browser_escape.txt` is therefore written outside the extraction directory.
The production trigger chain is:
1. Upload phase: An agent uploads a ZIP archive as a job report through `POST /api/flow/{name}/job/{number}/report`. The report metadata sets `zipped: true`.
2. Extraction phase:When an authenticated user requests the report through `GET /jobs/{flow}/{buildNumber}/reports/{reportId}`, `ReportServiceImpl.fetch()` passes the archive stream to `FileHelper.unzip(stream, destFile)`.
3. Path traversal: The `ZipEntry` name is joined to the destination path without validation, allowing the archive entry to escape the report extraction directory. |
|---|
| 来源 | ⚠️ https://glacier-tarsal-711.notion.site/Flow-ci-ZipSlip-Path-Traversal-in-flow-ci-FileHelper-unzip-During-Job-Report-Extraction-3f7b25e24b3680a8b7cec8c15d79a2fb |
|---|
| 用户 | Zy0t1 (UID 100983) |
|---|
| 提交 | 2026-10-13 10時28分 (26 日前) |
|---|
| 管理 | 2026-11-07 20時35分 (25 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 432649 [FlowCI flow-core-x 直到 1.23.49 FileHelper.java FileHelper.unzip 目录遍历] |
|---|
| 积分 | 17 |
|---|