CVE-2025-0851: aws deepjavalibrary Absolute Path Traversal
CVSS: 9.8v3.1CriticalDeferred
AliasesCGA-3xcq-fwjg-rv37CGA-g29f-38w9-5fvqCGA-2rx9-9x5j-m6gpCGA-2v8j-jh6h-mhrmCGA-34fm-gc8w-wp9vCGA-36x7-c63f-9cr6CGA-3g4v-4m27-hj62CGA-3vm7-fmgq-qq8xCGA-3w2g-h4f5-rc3fCGA-3wmx-rh8r-gm6vCGA-47q4-9j9w-h852CGA-47qj-rpvj-ch6wCGA-49h8-cqgg-2ggrCGA-4c76-fhrr-7h4qCGA-4pph-5p74-pvrxCGA-4r49-fm4g-gw75CGA-4rg6-23w7-m4p8CGA-52f7-3gxp-2736CGA-5c4v-q24f-84jfCGA-5v4j-r9j2-7r93CGA-62g2-5hqx-3425CGA-6392-6528-r826CGA-64xp-hcqw-2wccCGA-689m-8mph-j757CGA-6f5q-vgj2-j96vCGA-6jcp-v6xc-84c8CGA-6jr2-cwr3-2fxhCGA-7493-6qgx-gww9CGA-7m67-7g64-x84mCGA-8477-gjrm-4qg6CGA-8543-m98x-2f3wCGA-88hj-v877-5vjwCGA-9gh7-whhr-45h8CGA-9h46-9fw3-pcx3CGA-9mmm-c89r-4jp8CGA-c47c-m9h7-w77xCGA-ccqq-w974-9v5hCGA-cfc9-cq79-vghqCGA-cfrw-jfh9-vrhpCGA-cgxj-v8jv-4j4gCGA-cmvv-mv5w-2cppCGA-f2ch-qxvm-3h3wCGA-ffr4-9fxp-4m3wCGA-gcf3-rxqq-mc9cCGA-ghm9-cm8g-w54mCGA-gr7j-26x2-f4jfCGA-grjr-f9gr-2pwpCGA-gxxc-v264-fchgCGA-h5ff-9pqp-4r94CGA-h7m6-mr4m-pg77CGA-hhw2-jcqv-38mvCGA-hq2p-fp3c-xgw8CGA-hxpp-7r6p-vg47CGA-j493-86rm-3cj5CGA-j8hf-c47r-6rj6CGA-jw6w-5p6j-68rjCGA-jwxj-9g2j-265wCGA-m574-738m-3gqfCGA-m57p-v6q2-gqhgCGA-mgpg-phcr-c3w6CGA-mgvp-j82v-jh9wCGA-mwp2-m792-534jCGA-p86f-gq64-9w8xCGA-phgv-gm29-4cgjCGA-pj6w-26c6-g8w9CGA-pqvp-g3g6-vj4xGHSA-jcrp-x7w3-ffmgCGA-q5q3-4x5m-5vm3CGA-qc4q-8v6w-55j2CGA-r2hx-3jcg-gfc6CGA-r5jx-3g63-646rCGA-r5p5-47pf-qf26CGA-r9f5-7mqg-cc3hCGA-rv9v-554g-5vwxCGA-rxx8-2q94-4q3rCGA-v4cq-52w5-fjmjCGA-wj47-rjm7-jjjwCGA-wj8v-6wrj-5phmCGA-wm29-qc37-3643CGA-wpw9-qhvr-c5wgCGA-x28v-chr8-hcvcCGA-x89v-wff6-q42mCGA-x8g3-p9xm-3jj8CGA-xc76-g8hh-vqx3CGA-xp8j-3hrj-9g8q
Published 29-01-2025Last modified 14-10-2025
Vulnerability summary
CVE-2025-0851 is a critical (CVSS 9.8) Absolute Path Traversal vulnerability in aws deepjavalibrary. EPSS estimates a 23.27% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)EPSS score
23.27%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 3Timeline
- 29-01-2025PublishedVulnerability first disclosed.
- 14-10-2025Last modifiedVulnerability information updated.
Description
A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
CVSS metrics
8 scores · 5 sources · 2 versionsCritical 9.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- OSV · MavenEcosystem advisory · calculated9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST9.3CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Critical 9.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
23.27%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 23.27% on 18-09-2026
18-09-202618-10-2026
EPSS score23.27%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-36Absolute Path TraversalThe product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
Affected systems
Chainguard42 products
- opensearch-2< 2.19.1-r0
- opensearch-2-alerting< 2.19.1-r0
- opensearch-2-analysis-icu< 2.19.1-r0
- opensearch-2-analysis-kuromoji< 2.19.1-r0
- opensearch-2-analysis-nori< 2.19.1-r0
Ai.djl1 product
- api< 0.31.1
Aws1 product
- deepjavalibrary≥ 0.1.0, < 0.31.1
Wolfi1 product
- opensearch-2< 2.19.1-r0
4 vendors · 45 products
References
8 links- github.com/deepjavalibrary/djl/security/advisories/GHSA-jcrp-x7w3-ffmgThird Party AdvisoryAdvisoryWEB
