CVE-2021-22114: Path Traversal in Spring-integration-zip
Summary
CVE-2021-22114: Path Traversal in Spring-integration-zip. Affects org.springframework.integration:spring-integration-zip versions < 1.0.4. Fixed in 1.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring-integration-zip is a Maven package that provides integration support for handling zip archives in Spring applications. It allows for the extraction and manipulation of zip files within the Spring framework. However, versions prior to 1.0.4 are vulnerable to a path traversal attack, which can lead to arbitrary file write vulnerabilities. This vulnerability can be exploited by using a specially crafted zip archive that contains filenames with path traversal sequences. When these filenames are concatenated to the target extraction directory, the resulting path can extend outside of the intended target folder.
Vulnerability Detail
The path traversal vulnerability in Spring-integration-zip allows an attacker to write arbitrary files to the file system by manipulating the filenames within a zip archive. By including path traversal sequences in the filenames, an attacker can bypass the intended extraction directory and write files to arbitrary locations on the file system. This can lead to unauthorized access, data leakage, or even remote code execution if the written files are subsequently executed. The vulnerability affects other archive formats as well, including bzip2, tar, xz, war, cpio, and 7z.
How To Fix
Latest published version: 7.2.0-RC1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can implement input validation and sanitization measures to ensure that filenames within zip archives do not contain path traversal sequences. This can be done by checking the filenames against a whitelist of allowed characters and rejecting any filenames that contain directory traversal sequences such as '../'. Additionally, it is recommended to restrict the extraction directory to a specific location within the file system to prevent files from being written to unintended locations.
Conclusion
The path traversal vulnerability in Spring-integration-zip exposes an arbitrary file write vulnerability that can be exploited through specially crafted zip archives. Upgrading to version 1.0.4 or later and implementing input validation and sanitization measures can help mitigate the risk of this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.springframework.integration:spring-integration-zip →
FAQ
The vulnerability allows an attacker to write arbitrary files to the file system, potentially leading to unauthorized access, data leakage, or remote code execution.
Versions prior to 1.0.4 are affected by this vulnerability.
Yes, other archive formats such as bzip2, tar, xz, war, cpio, and 7z are also vulnerable to this path traversal attack.
Yes, upgrading to version 1.0.4 or later of the Spring-integration-zip package includes a partial fix for this vulnerability.
Implement input validation and sanitization measures to ensure that filenames within zip archives do not contain path traversal sequences. Additionally, restrict the extraction directory to a specific location within the file system.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.integration:spring-integration-zip.
