Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
apache/commons-compress
master @ 6744616
6
Fixes
0
CVEs
HIGH
Peak severity
16.7%
Coverage
Highlights
Path Traversal: 3 prior fixes. Scrutinize any change in this area.
src/main/java/org/apache/commons/compress/archivers/examples/Expander.java: most-fixed (1 issue). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Path traversal checks (Zip Slip) can be bypassed if target directory prefix validation does not account for name-prefix siblings, allowing extraction outside the destination folder unless canonical paths are compared with trailing path separators.
Integer Overflow: Inadequate bounds checking in stream reading utilities like `IOUtils.readFully` can lead to integer overflow conditions when index parameters wrap around to negative values, bypassing buffer size validations.
Path Traversal: Failing to consistently normalize file names, absolute paths, and filesystem roots in entry constructors or setters can lead to path traversal vulnerabilities when archive entries are extracted.