Hapifhir: >> Hl7 Fhir Core >> 5.6.94 Security Vulnerabilities
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists because of an incomplete fix for CVE-2023-24057.
CVSS Score
7.5
EPSS Score
0.005
Published
2023-12-12