Description
Path traversal in restore handler in Collibra Agent, allows an attacker to write arbitrary files via a crafted ZIP archive. Collibra Agent fails to properly validate and canonicalize file path during ZIP extraction, this can allow an attacker to write files outside the intended extraction directory.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Collibra Collibra Platform (SaaS)
2025.10 to < 2025.10.9affected
Collibra Collibra Platform (SaaS)
2025.11 to < 2025.11.7affected
Collibra Collibra Platform (SaaS)
2026.02 to < 2026.02.6affected
Collibra Collibra Platform (SaaS)
2026.03 to < 2026.03.4affected
Collibra Collibra Platform (SaaS)
2026.04 to < 2024.04.5affected
Collibra Collibra Platform (on-prem)
2026.03 to < 2026.03.356affected
Collibra Collibra Platform (on-prem)
2025.10 to < 2025.10.399affected