cve.bz

CVE-2023-5245

9.8 criticalEPSS 1.2%

Critical (9.8) in combust mleap. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in ml.combust.mleap:mleap-runtime_2.12 0.23.1.

FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directory. When creating an instance of TensorflowModel using the saved_model format and an exported tensorflow model, the apply() function invokes the vulnerable implementation of FileUtil.extract(). Arbitrary file creation can directly lead to code execution

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-897x-xvj8-42rqMavenml.combust.mleap:mleap-runtime_2.12<0.23.10.23.1

References

Check your stackJSON