Executive brief
Spring Integration's ZipTransformer component, a widely-used library for message processing, contains a path traversal vulnerability that allows an attacker to write ZIP archives to arbitrary locations on the filesystem. An attacker who can control the file_name header can bypass directory restrictions and write files outside the intended work directory, potentially compromising system integrity or enabling further attacks like code execution.
Technical details
The ZipTransformer component in Spring Integration fails to properly validate the file_name header when ZipResultType.FILE is configured (the default setting). This allows a path traversal attack via directory traversal sequences (e.g., ../ or absolute paths) in the file_name header. An attacker who can inject or control message headers reaching the ZipTransformer can cause the resulting .zip archive to be written outside the configured workDirectory. No authentication is required—the vulnerability is reachable to any attacker who can send a crafted message to the affected transformer. Patches are available for affected versions.
Affected products
- Spring Integration 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, 7.1.0
Timeline
- 2026-08-27: disclosed