Summary Vulnerability: Path Traversal in Archive Handling Leading to Code Execution GHSA ID: GHSA-x95v-2pgj-9x8j CVE ID: CVE-2021-39180 Severity: High Published Date: Aug 31, 2021 Affected Versions <15.5.3 Patched Versions 15.3.18, 15.5.3 Description The vulnerability allows an attacker to overwrite writable files by the application server user using a specially crafted ZIP file. Depending on configuration, this could extend to application server config files, Java code, or even operating system files. Impact Corruption or modification of OpenOlat files including course structures, config files, and test data. Possible Java code execution if JSP file execution is allowed and the context path is known. Code injection if the server and OpenOlat code deployment use the same user or if write permissions exist alongside a known context path. Patches The issue is resolved in versions 15.3.18, 15.5.3, and 16.0. Users are advised to upgrade to version 16.0.x. Workarounds No workarounds are available. An upgrade is required. References Jira Issue (Accessible to OpenOlat partners only) Contact Information For inquiries, contact: contact@openolat.org