Zip Slip (ARCH4106)

Key java.security.zip-slip · Severity error · Category security · CWE CWE-22

Writing archive entry paths to disk without verifying they stay within the target directory lets entry names containing ../ write files outside the intended directory.

Incorrect

ZipEntry e = zip.getNextEntry();
File out = new File(targetDir, e.getName());
Files.copy(zip, out.toPath());

Correct

Path base = targetDir.toPath().toRealPath();
Path out = base.resolve(e.getName()).normalize();
if (!out.startsWith(base)) throw new IOException("Zip slip: " + e.getName());
Files.copy(zip, out);

Fix

Resolve and normalize each entry path and verify it stays within the target directory before writing to disk.