The pf4j library versions prior to commit 20c2f80 contain a path traversal vulnerability (CWE-22) in the extract() function of Unzip.java. This flaw results from inadequate validation and normalization of zip entry names, which can be exploited to perform directory traversal or Zip Slip attacks. Such attacks may lead to overwriting or creating files outside the intended extraction directory, potentially impacting system availability. The vulnerability is remotely exploitable without privileges or user interaction, reflected by a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows an attacker to craft malicious zip files that, when extracted using the vulnerable pf4j library, can write files outside the intended directory. This can lead to denial of service or disruption of availability. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted zip files with vulnerable versions of pf4j. Monitor vendor communications for updates regarding patches or mitigations.