Listen to this Post
The vulnerability exists in the `unpackFile` function within the `ZipUtils.java` component of the lsfusion platform. This function is responsible for extracting files from a ZIP archive. The flaw occurs because the function does not properly sanitize or validate the paths of entries contained within the archive before writing them to the filesystem. An attacker can craft a malicious ZIP file that includes entries with absolute paths (e.g., ../../../../etc/passwd) or relative paths that traverse outside the intended target extraction directory. When the server processes this archive, the unsafe extraction logic follows the manipulated path, writing arbitrary files to unauthorized locations on the server’s filesystem. This path traversal can be exploited remotely by uploading a specially crafted ZIP file to a vulnerable endpoint that utilizes the affected `unpackFile` method.
Platform: lsfusion
Version: <=6.1
Vulnerability: Path Traversal
Severity: Medium
date: 11/17/2025
Prediction: Early 2026
What Undercode Say:
zip -r exploit.zip ../../../etc/passwd.txt
// In ZipUtils.unpackFile ZipEntry entry = entries.nextElement(); File newFile = new File(destinationDir, entry.getName()); // Missing path traversal check before write operation
How Exploit:
Craft malicious ZIP.
Upload to endpoint.
Trigger extraction.
Overwrite system files.
Protection from this CVE:
Validate entry paths.
Sanitize filenames.
Apply security patch.
Use latest version.
Impact:
File overwrite.
Data loss.
System compromise.
Unauthorized access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
