{"id":"CVE-2020-35460","details":"common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.","aliases":["GHSA-p9j6-4pjr-gp48"],"modified":"2026-07-08T22:13:24.886660Z","published":"2020-12-14T23:15:12.267Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"17.7"},{"last_affected":"17.12"}],"source":"CPE_RANGE","vendor_product":"oracle:primavera_unifier"},{"cpes":["cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*","cpe:2.3:a:oracle:primavera_unifier:21.12:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"16.1"},{"last_affected":"16.1"},{"introduced":"16.2"},{"last_affected":"16.2"},{"introduced":"18.8"},{"last_affected":"18.8"},{"introduced":"19.12"},{"last_affected":"19.12"},{"introduced":"21.12"},{"last_affected":"21.12"}],"source":"CPE_STRING","vendor_product":"oracle:primavera_unifier"}]},"references":[{"type":"ADVISORY","url":"http://www.mpxj.org/changes-report.html#a8.3.5"},{"type":"FIX","url":"https://github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpujan2021.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/joniles/mpxj","events":[{"introduced":"0"},{"fixed":"b0c789d136a174888d0cb41b706603df2c795676"},{"fixed":"8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:mpxj:mpxj:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"8.3.5"}]}}],"versions":["v8.3.4","v8.3.3","v8.3.2","v8.3.1","v8.3.0","v8.2.0","v8.1.4","v8.1.3","v8.1.2","v8.1.1","v8.1.0","v8.0.8","v8.0.7","v8.0.6","v8.0.5","v8.0.4","v8.0.3","v8.0.2","v8.0.0","v7.9.8","v7.9.7","v7.9.6","v7.9.5","v7.9.4","v7.9.3","v7.9.2","v7.9.1","v7.9.0","v7.8.4","v7.8.3","v7.8.2","v7.8.1","v7.8.0","v7.7.1","v7.7.0","v7.6.3","v7.6.2","v7.6.1","v7.6.0","v7.5.0","v7.4.4","v7.4.3","v7.4.2","v7.4.1","v7.4.0","v7.3.0","v7.2.1","v7.2.0","v7.1.0","v7.0.3","v7.0.2","v7.0.1","v7.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35460.json","vanir_signatures_modified":"2026-07-08T22:13:24Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["123141927248824563031288708808345287231","13077034134516116026565103736909882680","85603711740978062230026111542537678213","320194757104729912285574117987871137189","218070984230557849804256790131110018830","32725309723900027678955807783420864353","17620986167085260341268408789377049424","144262615154991053477131960923925827950"],"threshold":0.9},"id":"CVE-2020-35460-a3986cba","signature_type":"Line","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d","target":{"file":"src/main/java/net/sf/mpxj/common/InputStreamHelper.java"}},{"deprecated":false,"digest":{"function_hash":"213972228014475642471676651904999913297","length":588},"id":"CVE-2020-35460-e6f4b936","signature_type":"Function","signature_version":"v1","source":"https://github.com/joniles/mpxj/commit/8eaf4225048ea5ba7e59ef4556dab2098fcc4a1d","target":{"function":"processZipStream","file":"src/main/java/net/sf/mpxj/common/InputStreamHelper.java"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}