CVE-2018-1263: spring-integration-zip Arbitrary File Write
Summary
CVE-2018-1263: spring-integration-zip Arbitrary File Write. Affects org.springframework.integration:spring-integration-zip versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The spring-integration-zip package is a component of the Spring Integration framework that provides support for working with zip archives. It allows users to compress and decompress files and directories using various archive formats such as zip, bzip2, tar, xz, war, cpio, and 7z. This package is commonly used in Java applications for handling file compression and extraction tasks.
Vulnerability Detail
The spring-integration-zip package, versions prior to 1.0.2, is vulnerable to an arbitrary file write vulnerability. This vulnerability can be exploited by using a specially crafted zip archive that contains path traversal filenames. When the filename is concatenated to the target extraction directory, it can result in the extracted files being written outside of the intended target folder. This can lead to unauthorized access, data leakage, or potential code execution if the extracted files are executed as part of the application.
How To Fix
Latest published version: 7.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization mechanisms to ensure that user-supplied filenames do not contain any path traversal characters. This can be done by checking the filename against a whitelist of allowed characters and rejecting any filenames that contain directory traversal sequences such as '../'. Here is an example of how to perform input validation in Java:
String filename = ...; // User-supplied filename
if (filename.contains("../")) {
throw new IllegalArgumentException("Invalid filename: " + filename);
}
Conclusion
The spring-integration-zip package, versions prior to 1.0.2, is vulnerable to an arbitrary file write vulnerability. It is recommended to upgrade to the latest version of the package and implement input validation mechanisms to prevent path traversal attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.integration:spring-integration-zip →
FAQ
This vulnerability allows an attacker to write arbitrary files outside of the intended target folder. Depending on the context in which the extracted files are used, this can lead to unauthorized access, data leakage, or potential code execution.
Versions prior to 1.0.2 of the spring-integration-zip package are affected by this vulnerability.
Yes, other archive formats such as bzip2, tar, xz, war, cpio, and 7z are also affected by this vulnerability.
Yes, upgrading to version 1.0.2 or later of the spring-integration-zip package includes a partial fix for this vulnerability.
To prevent path traversal attacks, it is important to validate and sanitize user-supplied filenames before extracting files from zip archives. This can be done by checking the filenames against a whitelist of allowed characters and rejecting any filenames that contain directory traversal sequences.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.integration:spring-integration-zip.
