CVE-2025-0851

CVE-2025-0851 is a path traversal flaw (CWE-36, CWE-73) in the ZipUtils.unzip and TarUtils.untar helpers of Deep Java Library (DJL), affecting all platforms. It is triggered when an application extracts an attacker-supplied or attacker-influenced ZIP or TAR archive using these utilities, and crafted archive entry paths (absolute paths or ../ sequences) escape the intended extraction directory. A bad actor gains the ability to write files to arbitrary locations on the host; the CVSS 4.0 score of 9.3 (critical) rates the impact to the vulnerable system's confidentiality, integrity and availability as high, and in practice such arbitrary writes can enable overwriting of configuration, code or startup files leading to further compromise. Any application or service built with DJL that extracts untrusted ZIP/TAR archives with these utilities is affected, with exposure depending on whether extraction handles untrusted input. No public proof-of-concept or known in-the-wild exploitation exists at this time and the flaw is not in CISA KEV, but the 23.3% EPSS (98th percentile) indicates a meaningful probability of exploitation within 30 days.

What to do: Upgrade DJL to the patched release identified in the vendor advisory (the provided data does not state the fixed version, so verify against the official DJL GitHub releases/advisory). Until patched, avoid using ZipUtils.unzip/TarUtils.untar on untrusted archives, or pre-validate archive entries by rejecting absolute paths, '..' sequences, and entries that would escape the target directory. Given the elevated EPSS, organizations with DJL deployments should inventory usage and monitor for emerging PoCs or exploitation.