CVSS 3.0
7.5 highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCVE-2018-17297
High (7.5) in hutool hutool. EPSS 2.7% chance of exploitation in the next 30 days. Fixed in cn.hutool:hutool-parent 4.1.12.
The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
Severity
- EPSS
- 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hutool:hutool
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-rhq2-2574-78mc | Maven | cn.hutool:hutool-parent | <4.1.12 | 4.1.12 |
| GHSA-rhq2-2574-78mc | Maven | cn.hutool:hutool-all | <4.1.12 | 4.1.12 |
| GHSA-rhq2-2574-78mc | Maven | cn.hutool:hutool-core | <4.1.12 | 4.1.12 |