Every CVE Search/ Get API key

CVE-2023-24057

MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`

8.1 HighFix available

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.18%Up 0.3 points since Jan 25, 2023
90%50%10%1%

What each source reports

NVD Score used 8.1

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).

Record
CVE-2023-24057
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
CVE List 8.1

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).

Record
CVE-2023-24057
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2023-0498 8.1

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).

Record
EUVD-2023-0498
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-jqh6-9574-5x22 9.1

MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`

Impact

MITM can enable Zip-Slip.

Vulnerability

Vulnerability 1: Scanner.java

There is no validation that the zip file being unpacked has entries that are not maliciously writing outside of the intended destination directory. https://github.com/hapifhir/org.hl7.fhir.core/blob/8c43e21094af971303131efd081503e5a112db4b/org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java#L335-L357

This zip archive is downloaded over HTTP instead of HTTPS, leaving it vulnerable to compromise in-flight. https://github.com/hapifhir/org.hl7.fhir.core/blob/8c43e21094af971303131efd081503e5a112db4b/org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java#L136

Vulnerability 2: TerminologyCacheManager.java

Note: While these links point to only one implementation, both implementations of TerminologyCacheManager.java are vulnerable to this as their code seems to be duplicated.

While there is validation in this bit of logic that attempts to validate that the zip file doesn't contain malicious entries that escape the destination directory, the guard is insufficient.

https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/terminologies/TerminologyCacheManager.java#L97-L113

This is because the Utilities.path(String... path) method does not normalize the path, although it seems to be attempting to do so. https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/Utilities.java#L617-L675

The normalization only occurs if the path element starts with a path traversal payload. As an example, calling Utilities.path("/base", "/child/../test") will return the string "/base/child/../test".

This guard logic can, thus, be easily bypassed: https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/terminologies/TerminologyCacheManager.java#L100-L104

Assuming an attacker can control the return value of ze.getName(), they can supply a value like /anything/../../../../zipsip-protection-bypass.txt.

Similarly, an attacker can control the contents of the Zip file via a MITM attack as this logic is used with resources not downloaded over HTTPS.

https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/terminologies/TerminologyCacheManager.java#L66-L73

Patches

Unknown

Workarounds

Unknown

References

Record
GHSA-jqh6-9574-5x22
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
GitHub AdvisoriesGHSA-xr8x-pxm6-prjg 9.1

MITM based Zip Slip in `org.hl7.fhir.publisher:org.hl7.fhir.publisher`

Impact

MITM can enable Zip-Slip.

Vulnerability

Vulnerability 1: Publisher.java

There is no validation that the zip file being unpacked has entries that are not maliciously writing outside of the intended destination directory.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java#L3598-L3610

Vulnerability 2: WebSourceProvider.java

There is a check for malicious zip entries here, but it is not covered by test cases and could potentially be reverted in future changes.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/web/WebSourceProvider.java#L104-L112

Vulnerability 3: ZipFetcher.java

This retains the path for Zip files in FetchedFile entries, which could later be used to output malicious entries to another compressed file or file system.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/ZipFetcher.java#L57-L106

Vulnerability 4: IGPack2NpmConvertor.java

The loadZip method retains the path for entries in the zip file, which could later be used to output malicious entries to another compressed file or file system.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/IGPack2NpmConvertor.java#L442-L463

Record
GHSA-xr8x-pxm6-prjg
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.1

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).

Record
CVE-2023-24057
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-jqh6-9574-5x22 9.1

MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`

Impact

MITM can enable Zip-Slip.

Vulnerability

Vulnerability 1: Scanner.java

There is no validation that the zip file being unpacked has entries that are not maliciously writing outside of the intended destination directory. https://github.com/hapifhir/org.hl7.fhir.core/blob/8c43e21094af971303131efd081503e5a112db4b/org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java#L335-L357

This zip archive is downloaded over HTTP instead of HTTPS, leaving it vulnerable to compromise in-flight. https://github.com/hapifhir/org.hl7.fhir.core/blob/8c43e21094af971303131efd081503e5a112db4b/org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java#L136

Vulnerability 2: TerminologyCacheManager.java

Note: While these links point to only one implementation, both implementations of TerminologyCacheManager.java are vulnerable to this as their code seems to be duplicated.

While there is validation in this bit of logic that attempts to validate that the zip file doesn't contain malicious entries that escape the destination directory, the guard is insufficient.

https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/terminologies/TerminologyCacheManager.java#L97-L113

This is because the Utilities.path(String... path) method does not normalize the path, although it seems to be attempting to do so. https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.utilities/src/main/java/org/hl7/fhir/utilities/Utilities.java#L617-L675

The normalization only occurs if the path element starts with a path traversal payload. As an example, calling Utilities.path("/base", "/child/../test") will return the string "/base/child/../test".

This guard logic can, thus, be easily bypassed: https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/terminologies/TerminologyCacheManager.java#L100-L104

Assuming an attacker can control the return value of ze.getName(), they can supply a value like /anything/../../../../zipsip-protection-bypass.txt.

Similarly, an attacker can control the contents of the Zip file via a MITM attack as this logic is used with resources not downloaded over HTTPS.

https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/terminologies/TerminologyCacheManager.java#L66-L73

Patches

Unknown

Workarounds

Unknown

References

Record
GHSA-jqh6-9574-5x22
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-22
Updated
2026-11-02
OSVGHSA-xr8x-pxm6-prjg 9.1

MITM based Zip Slip in `org.hl7.fhir.publisher:org.hl7.fhir.publisher`

Impact

MITM can enable Zip-Slip.

Vulnerability

Vulnerability 1: Publisher.java

There is no validation that the zip file being unpacked has entries that are not maliciously writing outside of the intended destination directory.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java#L3598-L3610

Vulnerability 2: WebSourceProvider.java

There is a check for malicious zip entries here, but it is not covered by test cases and could potentially be reverted in future changes.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/web/WebSourceProvider.java#L104-L112

Vulnerability 3: ZipFetcher.java

This retains the path for Zip files in FetchedFile entries, which could later be used to output malicious entries to another compressed file or file system.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/ZipFetcher.java#L57-L106

Vulnerability 4: IGPack2NpmConvertor.java

The loadZip method retains the path for entries in the zip file, which could later be used to output malicious entries to another compressed file or file system.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/IGPack2NpmConvertor.java#L442-L463

Record
GHSA-xr8x-pxm6-prjg
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ca.uhn.hapi.fhir:org.hl7.fhir.core
Maven
 before 5.6.92
5.6.92
ca.uhn.hapi.fhir:org.hl7.fhir.convertors
Maven
 before 5.6.92
5.6.92
ca.uhn.hapi.fhir:org.hl7.fhir.r4b
Maven
 before 5.6.92
5.6.92
ca.uhn.hapi.fhir:org.hl7.fhir.r5
Maven
 before 5.6.92
5.6.92
ca.uhn.hapi.fhir:org.hl7.fhir.utilities
Maven
 before 5.6.92
5.6.92
ca.uhn.hapi.fhir:org.hl7.fhir.validation
Maven
 before 5.6.92
5.6.92
org.hl7.fhir.publisher:org.hl7.fhir.publisher
Maven
 before 1.2.30
1.2.30
ca.uhn.hapi.fhir:org.hl7.fhir.core
Maven
 before 5.6.92, plus listed versions
0.0.10.0.140.0.20.1.140.1.18
Show 45 moreShow less
1.0.01.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
5.6.92
ca.uhn.hapi.fhir:org.hl7.fhir.convertors
Maven
 before 5.6.92, plus listed versions
0.0.10.0.140.0.20.1.181.0.0
Show 45 moreShow less
1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
5.6.92
ca.uhn.hapi.fhir:org.hl7.fhir.r4b
Maven
 before 5.6.92, plus listed versions
5.6.225.6.235.6.245.6.255.6.26
Show 45 moreShow less
5.6.275.6.285.6.295.6.305.6.315.6.325.6.335.6.345.6.355.6.365.6.375.6.385.6.395.6.405.6.415.6.425.6.435.6.445.6.455.6.465.6.475.6.485.6.505.6.515.6.525.6.535.6.545.6.555.6.565.6.575.6.585.6.595.6.605.6.615.6.625.6.635.6.645.6.655.6.665.6.675.6.685.6.695.6.705.6.715.6.72
5.6.92
Show 4 moreShow less
Affected packages
PackageAffectedFixed
ca.uhn.hapi.fhir:org.hl7.fhir.r5
Maven
 before 5.6.92, plus listed versions
0.0.10.0.140.0.20.1.181.0.0
Show 45 moreShow less
1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
5.6.92
ca.uhn.hapi.fhir:org.hl7.fhir.utilities
Maven
 before 5.6.92, plus listed versions
0.0.10.0.140.0.20.1.181.0.0
Show 45 moreShow less
1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
5.6.92
ca.uhn.hapi.fhir:org.hl7.fhir.validation
Maven
 before 5.6.92, plus listed versions
0.0.10.0.140.0.20.1.181.0.0
Show 45 moreShow less
1.1.674.0.04.0.14.0.24.0.34.1.04.2.05.0.05.0.105.0.115.0.125.0.135.0.145.0.155.0.165.0.175.0.185.0.195.0.205.0.215.0.225.0.75.0.85.0.95.1.05.1.15.1.105.1.115.1.125.1.135.1.145.1.155.1.165.1.175.1.185.1.195.1.25.1.205.1.215.1.225.1.35.1.45.1.55.1.65.1.7
5.6.92
org.hl7.fhir.publisher:org.hl7.fhir.publisher
Maven
 before 1.2.30, plus listed versions
1.1.01.1.11.1.101.1.111.1.12
Show 45 moreShow less
1.1.1241.1.1251.1.1261.1.1271.1.1281.1.1291.1.131.1.1301.1.1311.1.141.1.151.1.161.1.171.1.181.1.191.1.21.1.201.1.211.1.221.1.231.1.241.1.251.1.261.1.271.1.281.1.291.1.31.1.301.1.311.1.321.1.331.1.341.1.351.1.361.1.371.1.381.1.391.1.41.1.401.1.411.1.421.1.431.1.441.1.451.1.46
1.2.30

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-24057 is a high vulnerability (CVSS 8.1) in Hapifhir Hl7 Fhir Core, published January 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in ca.uhn.hapi.fhir:org.hl7.fhir.core 5.6.92.

References

This page doesn't list everything

Left out here: 788 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open