CVE-2023-24057 MITM based Zip Slip in `ca.uhn.hapi.fhir:org.hl7.fhir.core`

What is CVE-2023-24057?

CVE-2023-24057 is a high-severity path traversal vulnerability in n/a, published on 24 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).

Weakness: CWE-22

Which versions are affected by CVE-2023-24057?

14 open source packages ship an affected version, including ca.uhn.hapi.fhir:org.hl7.fhir.convertors, ca.uhn.hapi.fhir:org.hl7.fhir.core and ca.uhn.hapi.fhir:org.hl7.fhir.r4b. It affects 2 products.

Products include Hapifhir Hl7 Fhir Core, Hl7 Fhir Ig Publisher.

How do I fix CVE-2023-24057?

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.convertors to 5.6.92 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2023-24057 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-24057 exists.

Other vulnerabilities in n/a

• CVE-2026-34361 HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Theft Critical 9.3
• CVE-2026-55471 HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory High 8.7
• CVE-2026-55470 HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoS High 7.5
• CVE-2023-28465 HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057 High 7.5
• CVE-2026-34359 HAPI FHIR: Authentication Credential Leakage via Improper URL Prefix Matching on HTTP Redirect in HAPI FHIR Core High 7.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-jqh6-9574-5x22, GHSA-xr8x-pxm6-prjg.