Miggo Logo
Miggo Vulnerability Database
→
CVE-2025-0851

CVE-2025-0851: Deep Java Library path traversal issue

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2025-0851
GHSA ID
GHSA-jcrp-x7w3-ffmg
EPSS Score
0.81506%
CWE
CWE-22
Published
1/29/2025
Updated
1/30/2025
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
ai.djl:apimaven< 0.31.10.31.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper path validation in archive extraction utilities. The commit diff shows both TarUtils.untar and ZipUtils.unzip were modified to replace their flawed validation logic with a new method (validateArchiveEntry) that checks path normalization and containment within the destination. The original code in these functions used insufficient checks (e.g., simple '..' detection and separator stripping), which failed to prevent absolute path traversal when archives were created on one OS and extracted on another. The CWE-22/CWE-36 alignment and the explicit patch targeting these functions confirm their vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

## Summ*ry [***p J*v* Li*r*ry (*JL)](*ttps://*o*s.*jl.*i/m*st*r/in**x.*tml) is *n op*n-sour**, *i**-l*v*l, *n*in*-**nosti* J*v* *r*m*work *or ***p l**rnin*. *JL is **si*n** to ** **sy to **t st*rt** wit* *n* simpl* to us* *or J*v* **v*lop*rs. *JL pr

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* v*li**tion in *r**iv* *xtr**tion utiliti*s. T** *ommit *i** s*ows *ot* `T*rUtils.unt*r` *n* `ZipUtils.unzip` w*r* mo*i*i** to r*pl*** t**ir *l*w** v*li**tion lo*i* wit* * n*w m*t*o* (`v*li**t**r**iv**ntry`)