Loading story…
A bug bounty researcher chained an XML External Entity (XXE) flaw with a ZIP directory-traversal vulnerability in an unnamed Java web application that accepted a custom ZIP-based .xyz package. The application extracted uploaded archives and parsed an XML manifest, allowing a locally referenced external entity to expose /etc/hosts and support further directory enumeration.
After identifying an application JSP template, the researcher used the archive extraction flaw—commonly known as Zip Slip—to overwrite it with a web shell, achieving remote code execution once cached content expired. The case demonstrates how unsafe XML parser defaults and insufficient archive-path validation can turn file-upload functionality into server compromise; the organization reportedly remediated the findings within 12 hours.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The unnamed organization's security team reportedly fixed the chained XXE and ZIP directory-traversal vulnerabilities in less than 12 hours after they were reported.
The researcher used XXE directory enumeration to identify a JSP template, then exploited ZIP directory traversal during archive extraction to overwrite sitemap.jsp with a web shell. The shell became accessible after cached content expired, resulting in remote code execution on the application server.
A bug bounty researcher found that an unnamed Java web application accepted ZIP-based .xyz uploads and processed an XML manifest with XXE enabled. A local entity referencing file:///etc/hosts disclosed the server's hosts file in the application's confirmation page.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A vulnerability chain in **LSP4XML**, the XML parsing library used by **VSCode-XML**, **Eclipse wildwebdeveloper**, **Theia XML tooling**, and related products, allowed attackers to achieve code execution by luring users into opening a malicious XML file. The first flaw, **CVE-2019-18213**, was an **XXE** issue that could be triggered during XML parsing and enabled effects including **blind SSRF** and **NetNTLMv2** credential leakage on Windows systems. Researchers found a second flaw, **CVE-2019-18212**, in LSP4XML’s caching logic that allowed **path traversal** and arbitrary file write in user-accessible directories. By chaining the XXE bug with the file-write weakness, an attacker could place startup or autostart files and gain execution after the victim logged out and back in. The issues were fixed in **LSP4XML 0.9.1**, and the case highlights how XML parser weaknesses can be combined with **server-side request forgery** behavior and local file-write primitives to escalate into full compromise.
Jul 24, 2026
A high-severity directory traversal flaw, **CVE-2026-17524**, has been disclosed in the `zip-lib` package before version `1.1.0`, allowing attackers to bypass extraction safeguards and write files outside the intended destination folder. The bug stems from cached path-validation results during archive extraction: `zip-lib` checks the `isOutsideTargetFolder` condition only when an initial directory symlink is created, enabling later archive entries to evade traversal protections. The issue is mapped to **CWE-22** and carries a **CVSS 3.1** score reflecting network-exploitable impact with high confidentiality risk. The vulnerability fits the long-running **Zip Slip** class of archive extraction bugs, in which crafted archive entries such as `../../` paths can overwrite arbitrary files and potentially lead to remote code execution across ZIP, TAR, JAR, CPIO, and other formats. Security research has shown this pattern affects thousands of projects across multiple ecosystems when extraction logic concatenates archive entry names without robust validation, and offensive testing tools such as **Archive Pwn** have made it easier to generate malicious archives using traversal paths, symlink abuse, Unicode tricks, and other bypass techniques. The `zip-lib` disclosure underscores that archive handling remains a persistent software supply chain and application security risk even years after the original Zip Slip wave of fixes.
Jul 29, 2026
Attackers are actively scanning for and attempting to exploit critical Apache Struts file upload vulnerabilities `CVE-2024-53677` and `CVE-2023-50164`, both of which stem from improper handling of upload parameters that can enable path traversal and unauthorized file placement. Security researchers reported internet-wide enumeration and exploitation activity following public disclosure and the appearance of proof-of-concept code on GitHub and in technical write-ups, with attackers seeking to upload malicious files into restricted directories. Successful exploitation can allow deployment of JSP web shells and lead to remote code execution on vulnerable Struts applications, depending on how file upload features are exposed and sanitized in each environment. The flaws affect multiple Struts branches, including legacy 2.x and 6.x releases, and defenders have been urged to upgrade to fixed versions such as Struts `2.5.33`, `6.3.0.2`, or `6.4.0` as applicable, migrate away from legacy upload mechanisms, restrict access to upload interfaces, apply WAF protections, and monitor for suspicious JSP file creation and execution.
Aug 21, 2026