Path traversal in Deep Java Library archive extraction
Deep Java Library versions prior to 0.31.1 contained a path traversal vulnerability in archive extraction utilities that could allow arbitrary files to be written outside the intended directory when extracting model archives across different operating systems. The issue was patched in version 0.31.1.
What happened
Deep Java Library (DJL) versions 0.1.0 through 0.31.0 contained a path traversal vulnerability in the untar and unzip utilities used to extract model archives.
An attacker could create a malicious archive on one operating system that, when extracted on a different operating system (Windows to macOS/Linux or vice versa), would write files outside the intended destination directory.
Reported impact
The vulnerability has a CVSS score of 9.8 (Critical) with high impact on confidentiality, integrity, and availability, requiring no user interaction or privileges to exploit.
Index analysis
The issue affects the archive extraction process when handling model files loaded by DJL, potentially allowing arbitrary file writes during extraction of untrusted archives.
Governance controls
DJL released patch version 0.31.1 to fix the cross-platform archive extraction issue.
Users are advised not to extract model archives from untrusted sources and to only use models from official sources such as the DJL Model Zoo or self-created packages.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.