EDDI Path Traversal Vulnerability in ZIP Import Function
EDDI, a conversational AI platform, contained a path traversal vulnerability in its ZIP import function that could allow attackers to write files outside the intended directory and potentially execute remote code. The vulnerability was patched in version 5.5.0.
What happened
The ZIP file import functionality in EDDI versions before 5.5.0 contained a path traversal vulnerability (Zip Slip) in the /backup/import API endpoint.
When extracting ZIP archives, the application did not properly sanitize or validate filenames for path traversal sequences, allowing a maliciously crafted ZIP file to write files outside the intended extraction directory.
Reported impact
An attacker with access to the /backup/import API endpoint could overwrite application files such as JAR libraries owned by the application user, potentially leading to Remote Code Execution within the application's context.
Although the application runs as a non-root user, limiting direct impact on system-level files, the vulnerability could still be exploited to compromise application integrity.
Index analysis
The vulnerability was identified in the ZipArchive class's unzip method, which used entry names from ZIP files to construct destination paths without proper validation.
Governance controls
The vulnerability was patched in version 5.5.0 by implementing proper validation of file paths from ZIP entries to prevent traversal outside the intended directory.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.