CVE-2018-17297: Arbitrary File Overwrite in Hutool
Summary
CVE-2018-17297: The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive. Affects cn.hutool:hutool-parent versions < 4.1.12. Fixed in 4.1.12. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Hutool is an open-source Java library that provides a wide range of utility functions for developers. It includes various modules such as file handling, network communication, encryption, and more. The library is widely used in Java applications to simplify common programming tasks and improve productivity. However, a vulnerability has been discovered in the unzip function of the ZipUtil.java file in Hutool versions prior to 4.1.12.
Vulnerability Detail
The vulnerability allows remote attackers to overwrite arbitrary files by exploiting directory traversal sequences in a filename within a ZIP archive. By manipulating the file path in the ZIP archive, an attacker can traverse directories and overwrite files outside the intended extraction directory. This can lead to unauthorized modification or deletion of critical files, potentially compromising the integrity and security of the affected system.
How To Fix
Latest published version: 5.8.48 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround is to implement input validation and sanitization when processing ZIP archives. This can involve checking the file paths within the archive and ensuring they are within the intended extraction directory. Additionally, it is important to restrict access to the extraction directory to prevent unauthorized modifications.
Conclusion
The vulnerability in Hutool allows remote attackers to overwrite arbitrary files through directory traversal in ZIP archives. To mitigate this vulnerability, it is crucial to update Hutool to version 4.1.12 or later. Implementing input validation and sanitization when processing ZIP archives can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for cn.hutool:hutool-parent →
FAQ
The vulnerability allows remote attackers to overwrite arbitrary files, potentially leading to unauthorized modification or deletion of critical files on the affected system.
No, only versions prior to 4.1.12 are affected. It is recommended to update to the latest secure version to mitigate the vulnerability.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fixes to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely by sending a specially crafted ZIP archive to the target system.
Yes, the CVSS score for this vulnerability is 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
