CVSS 3.1
8.1 highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2023-24057
High (8.1). EPSS 1.2% chance of exploitation in the next 30 days. Fixed in ca.uhn.hapi.fhir:org.hl7.fhir.core 5.6.92.
HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hapifhir:hl7_fhir_core
- hl7:fhir_ig_publisher
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jqh6-9574-5x22 | Maven | ca.uhn.hapi.fhir:org.hl7.fhir.core | <5.6.92 | 5.6.92 |
| GHSA-jqh6-9574-5x22 | Maven | ca.uhn.hapi.fhir:org.hl7.fhir.convertors | <5.6.92 | 5.6.92 |
| GHSA-jqh6-9574-5x22 | Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r4b | <5.6.92 | 5.6.92 |
| GHSA-jqh6-9574-5x22 | Maven | ca.uhn.hapi.fhir:org.hl7.fhir.r5 | <5.6.92 | 5.6.92 |
| GHSA-jqh6-9574-5x22 | Maven | ca.uhn.hapi.fhir:org.hl7.fhir.utilities | <5.6.92 | 5.6.92 |
| GHSA-jqh6-9574-5x22 | Maven | ca.uhn.hapi.fhir:org.hl7.fhir.validation | <5.6.92 | 5.6.92 |
| GHSA-xr8x-pxm6-prjg | Maven | org.hl7.fhir.publisher:org.hl7.fhir.publisher | <1.2.30 | 1.2.30 |