CVE-2018-1263

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-15 · updated 2026-06-17
Weakness: CWE-22

Description

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.

Affected products

Pivotal Spring Integration Zip: before 1.0.2 — fixed in 1.0.2
Pivotal Spring Integration Zip: versions prior to 1.0.2

How to fix

Upgrade to a fixed version: Pivotal Spring Integration Zip 1.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-1263 or the next vulnerability affects your stack