Junglewise Threat Intelligence

land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

Severity: low · CVSS 3.1 · Published 2026-07-01

Vendors: Maven.

Executive brief

land.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory

Affected products

  • Maven land.oras:oras-java-sdk

Related threats