DEEP JAVA LIBRARY VULNERABILITY ALLOWS PATH TRAVERSAL

Summary from the TLDR InfoSec newsletter

A new vulnerability in the ZipUtils.unzip and TarUtils.untar utilities in the Deep Java Library allows for absolute path traversal. These utilities are used by Deep Java Library when extracting models to load. The vulnerability exists because the absolute path is not properly validated. A malicious attacker could exploit this vulnerability to overwrite system files.