A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
The issue affects the ZipUtils.unzip and TarUtils.untar methods in the DJL library. When unpacking ZIP or TAR archives, the library does not properly validate the paths contained in the archive. An attacker can prepare a malicious archive containing entries with paths containing traversal sequences (e.g., '../'), which allows files to be written outside the intended target directory — to any location accessible to the process. The vulnerability is classified as CWE-36 (absolute path traversal) and CWE-73 (external control of file name or path).
An attacker can write arbitrary files to any locations in the file system that are accessible to the process running DJL. This can lead to overwriting critical configuration files, injecting malicious code, or taking control of the system.
Deep Java Library (DJL) should be updated to version v0.31.1 or newer, in which the issue has been fixed. Details are available in the vendor references: https://github.com/deepjavalibrary/djl/releases/tag/v0.31.1 and in the AWS security bulletin: https://aws.amazon.com/security/security-bulletins/AWS-2025-003/
Deep Java Library (DJL) on all platforms — versions before v0.31.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X