Home » Database

AVID-2026-R1649

Description

Path traversal issue in Deep Java Library (CVE-2025-0851)

Details

A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.

Reason for inclusion in AVID: CVE-2025-0851 describes a path traversal vulnerability in DJL’s unzip and untar utilities. DJL (Deep Java Library) is an AI framework/library used in ML pipelines for model loading/inference, making this vulnerability relevant to AI software stacks. The issue affects software components used to build/run general-purpose AI systems (dependency/artifact handling), constituting a software supply chain vulnerability rather than hardware/firmware. The CVE entry, CWE mappings, CVSS metrics, and references provide clear signals of impact and exploitation potential.

References

Affected or Relevant Artifacts

  • Developer: AWS
  • Deployer: AWS
  • Artifact Details:
TypeName
SystemDeepJavaLibrary

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score9.8
Base Severity🔴 Critical
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-36CWE-36: Absolute Path Traversal
CWE-73CWE-73: External Control of File Name or Path

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-01-29
  • Version: 0.3.3
  • AVID Entry