cve.bz

CVE-2022-25842

9.8 criticalEPSS 3.9%

Critical (9.8) in alibabagroup one-java-agent. EPSS 3.9% chance of exploitation in the next 30 days. Fixed in com.alibaba.oneagent:one-java-agent-plugin 0.0.2.

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-9hr3-j9mc-xmq2Mavencom.alibaba.oneagent:one-java-agent-plugin<0.0.20.0.2

References

Check your stackJSON