The quarkus-openapi-generator extension for Quarkus versions before 2.16.0 and 2.15.0-lts contains a path traversal vulnerability (CWE-22) in the unzip() method of ApicurioCodegenWrapper.java. The method constructs destination file paths by concatenating the output directory with ZIP entry names without validating that the resulting path remains within the intended directory. Malicious ZIP archives with entries containing path traversal sequences (e.g., ../../malicious.java) can cause files to be written outside the target directory, potentially overwriting arbitrary files on the host filesystem. This vulnerability is fixed in versions 2.16.0 and 2.15.0-lts.

Successful exploitation allows an attacker to write files outside the designated output directory by crafting ZIP archives with path traversal sequences. This could lead to overwriting critical files or placing malicious files in arbitrary locations, potentially compromising system integrity or enabling further attacks. There are no known exploits in the wild at this time.

Upgrade to quarkus-openapi-generator version 2.16.0 or 2.15.0-lts or later, where this path traversal vulnerability has been fixed. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.