Read the docs
TI-2018-14334 Aliases CVE-2018-20227GHSA-x3cr-x949-h5jv

RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.

Priority LOW 36CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a ZIP archive.

Why it matters now

EPSS 0.01824 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.eclipse.rdf4j:rdf4j (Maven): 2.5.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.eclipse.rdf4j:rdf4j (Maven)before 2.5.02.5.0Patch availableGHSA-x3cr-x949-h5jv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.eclipse.rdf4j:rdf4j (Maven) Vendor— Affected before 2.5.0 Fixed in 2.5.0 Patch available GHSA-x3cr-x949-h5jv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:rdf4j:*:*:*:*:*:*:*:*before 2.5.0VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:rdf4j:*:*:*:*:*:*:*:* Versions before 2.5.0 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-x3cr-x949-h5jv org.eclipse.rdf4j:rdf4j (Maven) Fixed in 2.5.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-20227
  2. 2026-10-03 Alias added: GHSA-x3cr-x949-h5jv

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2018-15997 Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE)… CVSS 3.0CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences