The quarkus-openapi-generator extension for Quarkus versions before 2.16.0 and 2.15.0-lts contains a path traversal vulnerability (CWE-22) in the unzip() method of ApicurioCodegenWrapper.java. Specifically, ZIP entries are extracted without validating that the resolved file paths stay within the designated output directory. The code constructs the destination file path by combining the output directory and the ZIP entry name without sanitization, enabling an attacker to craft ZIP archives with entries containing path traversal sequences (e.g., ../../malicious.java). This can lead to arbitrary file writes outside the intended directory. The vulnerability is fixed in versions 2.16.0 and 2.15.0-lts.

Successful exploitation allows an attacker to write files to arbitrary locations on the filesystem where the application has write permissions. This can lead to overwriting critical files, potentially enabling code execution or disruption of application behavior. The CVSS 4.0 score of 7.7 reflects a high severity with network attack vector, no privileges required, no user interaction, and high impact on integrity.

Upgrade quarkus-openapi-generator to version 2.16.0 or 2.15.0-lts or later, where the vulnerability is fixed. Patch status is confirmed by the vendor advisory indicating the fix is included in these versions. Until upgraded, avoid processing untrusted ZIP archives with this component.