-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key points: 1) ZipPluginLoader's extraction logic (CWE-22) doesn't sanitize ZIP entry names, allowing path traversal via '../' sequences. 2) DefaultPluginManager's loadPluginFromPath accepts untrusted input (zippluginPath) without validation (CWE-94), enabling code injection. The combination allows writing arbitrary files to sensitive locations, which when combined with plugin loading mechanisms, leads to RCE. The GitHub issue explicitly mentions these components in the attack flow, and the CWEs map directly to these vulnerable patterns.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.pf4j:pf4j | maven | <= 3.9.0 |