CVE-2023-27603: Apache Linkis Zip Slip issue
Summary
CVE-2023-27603: Apache Linkis Zip Slip issue. Affects org.apache.linkis:linkis versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Linkis is a package in the Maven ecosystem that provides a Manager module engineConn material upload feature. This package is vulnerable to a Zip Slip issue in versions <=1.3.1. The vulnerability arises due to the lack of proper validation of the zip path during material upload. This can potentially lead to a remote code execution (RCE) vulnerability.
Vulnerability Detail
The Zip Slip issue in Apache Linkis allows an attacker to exploit the package's Manager module engineConn material upload feature. By manipulating the zip path, an attacker can traverse directories and overwrite arbitrary files on the system. This can result in the execution of malicious code, compromising the integrity and confidentiality of the affected system.
How To Fix
Latest published version: 1.8.0 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version (1.3.2) to address the Zip Slip issue effectively.
Conclusion
The Apache Linkis package is vulnerable to a Zip Slip issue that can lead to remote code execution. It is highly recommended to upgrade to version 1.3.2 to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.linkis:linkis →
FAQ
Apache Linkis is a package in the Maven ecosystem that provides a Manager module engineConn material upload feature.
Zip Slip is a vulnerability that occurs when an application fails to properly validate the paths of files within a zip archive. It allows an attacker to overwrite arbitrary files on the system by manipulating the zip path.
This vulnerability can lead to remote code execution (RCE) on the affected system. An attacker can potentially execute malicious code, compromising the integrity and confidentiality of the system.
To fix this vulnerability, upgrade the version of Linkis to version 1.3.2. This version includes the necessary fixes to prevent the Zip Slip issue.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version (1.3.2) to address the Zip Slip issue effectively.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.linkis:linkis.
