Goomph before 3.37.2 allows malicious zip file to write contents to arbitrary locationsGHSA-p2f7-9cv7-jjf6
HIGHFix: diffplug/goomph#198GHSA-p2f7-9cv7-jjf6 is a high-severity (CVSS 8.8) Path Traversal vulnerability in com.diffplug.gradle:goomph. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for com.diffplug.gradle:goomph — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
com.diffplug.gradle:goomphReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability.
Note: This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | com.diffplug.gradle:goomph | all versions | 3.37.2com.diffplug.gradle:goomph:3.37.2 |
Affected Products
goomphdiffplugResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.diffplug.gradle:goomph, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update com.diffplug.gradle:goomph to 3.37.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-p2f7-9cv7-jjf6 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Frequently Asked Questions
Is GHSA-p2f7-9cv7-jjf6 in your dependencies?
Find it across Maven, including transitive dependencies.