CVE Feed

    Dashboard / CVE / CVE-2023-24057

    CVE-2023-24057

    HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).

    Published:Jan 24, 2023
    Last Modified:Apr 1, 2025
    EPS:Jan 24, 2023
    EPSS Score:0.00833
    CVSS Score:8.1

    Affected Products

    Vendor
    Hapifhir
    Product
    Hl7 Fhir Core
    Vendor
    Hl7
    Product
    Fhir Ig Publisher

    Exploits

    https://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-xr8x-pxm6-prjghttps://github.com/HL7/fhir-ig-publisher/security/advisories/GHSA-xr8x-pxm6-prjghttps://github.com/shoucheng3/hapifhir__org_hl7_fhir_core_CVE-2023-24057_5-6-91https://github.com/shoucheng3/hapifhir__org_hl7_fhir_core_CVE-2023-24057_5-6-911

    Related CVEs

    CVE-2026-62296 (CVSS 7.5) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…
    CVE-2026-62295 (CVSS 7.5) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…
    CVE-2026-62293 (CVSS 5) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…
    CVE-2026-49485 (CVSS 7.5) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…
    CVE-2026-45367 (CVSS 7.5) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…
    CVE-2026-55471 (CVSS 8.7) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…
    CVE-2026-55470 (CVSS 7.5) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…
    CVE-2026-34361 (CVSS 9.3) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…
    CVE-2026-34360 (CVSS 5.8) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…
    CVE-2026-34359 (CVSS 7.4) — HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High