-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient validation of zip entry names during import. The pre-patch version of getFileFromTemporaryDirectory() directly used untrusted zip entry names to construct file paths, enabling directory traversal via '../' sequences. The writeJsonToFile() function then wrote content to these unvalidated paths. The fix added validation in getFileFromTemporaryDirectory() using hasRelativeParentPath() to detect traversal attempts, confirming these functions were the vulnerability entry points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.atlas:apache-atlas | maven | >= 0.8.4, < 2.3.0 | 2.3.0 |
A Semantic Attack on Google Gemini - Read the Latest Research