CVE-2023-28465

2023-12-1200:00:00

mitre

www.cve.org

hl7 fhir core libraries

package decompression

directory traversal

8.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.5%

JSON

The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists because of an incomplete fix for CVE-2023-24057.