OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.

Not available: CISA has not published SSVC decision points for this record.

• — Vendor— Affected all versions Fixed in — No fix listed CNA
• org.openrefine:main (Maven) Vendor— Affected before 3.2-beta Fixed in 3.2-beta Patch available GHSA-f6fv-fjg8-4m6w

• Fix · GHSA-f6fv-fjg8-4m6w org.openrefine:main (Maven) Fixed in 3.2-beta Advisory →

1. 2026-10-02 Threatist record created from CVE-2018-19859
2. 2026-10-03 Alias added: GHSA-f6fv-fjg8-4m6w

• TI-2023-22279 Remote Code exec in project import with mysql jdbc url attack CVSS 3.1CRITICAL 9.8
• TI-2024-32135 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE) CVSS 3.1HIGH 8.8
• TI-2024-32133 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF) CVSS 3.1HIGH 8.8
• TI-2023-22278 OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack CVSS 3.1HIGH 7.5
• TI-2024-32134 OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand CVSS 3.1HIGH 8.1
• TI-2024-32132 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt) CVSS 3.1HIGH 8.1

• CVE-2018-19859 · CVE Program
• CVE-2018-19859 · NVD
• FIRST EPSS
• GHSA-f6fv-fjg8-4m6w · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences