CVE-2025-23011
Fedora Repository archive extraction path traversal
Summary
Fedora Repository archive extraction path traversal
Original description
The description as published by the source.
Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
References
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- package github.com
- web raw.githubusercontent.com