CVE-2019-0191

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.

• CWE-22

• http://www.securityfocus.com/bid/107462Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/6856aa7ed7dd805eaf65d0e5e95027dda3b2307aacd1ab4a838c5cd1%40%3Cuser.karaf.apache.org%3E
• https://lists.apache.org/thread.html/cef9a2d4b547625e5214684283ac5c59c9d9740e092e777dc3f85070%40%3Ccommits.karaf.apache.org%3E
• http://www.securityfocus.com/bid/107462Third Party Advisory, VDB Entry
• https://lists.apache.org/thread.html/6856aa7ed7dd805eaf65d0e5e95027dda3b2307aacd1ab4a838c5cd1%40%3Cuser.karaf.apache.org%3E
• https://lists.apache.org/thread.html/cef9a2d4b547625e5214684283ac5c59c9d9740e092e777dc3f85070%40%3Ccommits.karaf.apache.org%3E

Published

Mar 21, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-0185Insufficient access control in protected memory subsystem fo…5.5
• CVE-2019-0186The input fields of the Apache Pluto "Chat Room" demo portle…
• CVE-2019-0187Unauthenticated RCE is possible when JMeter is used in distr…
• CVE-2019-0188Apache Camel prior to 2.24.0 contains an XML external entity…7.5
• CVE-2019-0189The java.io.ObjectInputStream is known to cause Java seriali…9.8
• CVE-2019-0190A bug exists in the way mod_ssl handled client renegotiation…7.5
• CVE-2019-0192In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, t…
• CVE-2019-0193In Apache Solr, the DataImportHandler, an optional but popul…7.2
• CVE-2019-0194Apache Camel's File is vulnerable to directory traversal. Ca…
• CVE-2019-0195Manipulating classpath asset file URLs, an attacker could gu…9.8
• CVE-2019-0196A vulnerability was found in Apache HTTP Server 2.4.17 to 2.…
• CVE-2019-0197A vulnerability was found in Apache HTTP Server 2.4.34 to 2.…4.2