Although I withheld the report as it required additional verification, I have not yet been able to proceed due to being occupied with my primary job. Given that significant time has passed since I identified it, I decided to report it first.

Title

Zip Slip in Bootstrap.unzip allows arbitrary file write via crafted ZIP archive

Summary

Bootstrap.unzip() extracts ZIP entries using new File(destDir, entry.getName()) without any canonical-path validation. A crafted ZIP archive with ../ sequences in entry names can write files outside the intended destination directory on the OneDev server.

• Constraints: Requires administrator-level access via backup restore (RestoreDatabase.java:73) or plugin .zip deployment. Local network or admin console access required.
• Vulnerable action: Bootstrap.unzip() passes ZipEntry.getName() directly to new File(destDir, entryName) (lines 351–363, Bootstrap.java). No getCanonicalPath().startsWith() guard is present. Entry names containing ../../../../etc/cron.d/backdoor resolve outside destDir at the OS level.
• Result: An administrator-controlled ZIP payload writes to arbitrary paths reachable by the OneDev process user. Escalation to RCE is possible via cron.d injection or overwriting server configuration files.

Details

File: commons-bootstrap/src/main/java/io/onedev/commons/bootstrap/Bootstrap.java, lines 347–369

while((entry = zis.getNextEntry()) != null) {
    var file = new File(destDir, entry.getName());  // no canonical path check
    createDir(file.getParentFile());
    new FileOutputStream(file) // writes outside destDir if getName() contains ../

Missing guard: file.getCanonicalPath().startsWith(destDir.getCanonicalPath() + File.separator).

Trigger paths:

• RestoreDatabase.java:73 — backup restore via CLI/UI
• Plugin .zip deployment via admin panel

PoC

Dynamic verification — exact Bootstrap.unzip replica:

Input ZIP entry name: "../../../../target_escape.txt"
destDir: /data/artifacts/project1/build1/
Result file: /target_escape.txt

Execution output:
destDir (artifacts): /private/tmp/fakeonedep/data/artifacts/project1/build1
Target escape:       /private/tmp/fakeonedep/target_escape.txt

[*] Running vulnerable Bootstrap.unzip...
[VULN CONFIRMED] Written to: /private/tmp/fakeonedep/target_escape.txt
                 Content: ZIP SLIP: written outside artifacts dir via Bootstrap.unzip

File written 4 directory levels above destDir.

Impact

Any OneDev instance where an administrator performs a backup restore or installs a plugin via ZIP upload. Allows overwrite of arbitrary server-side files at OneDev process privilege, leading to RCE via cron.d, SSH key injection, or config file tampering.

Recommended Fix

var file = new File(destDir, entry.getName());
String canonicalDest = destDir.getCanonicalPath() + File.separator;
if (!file.getCanonicalPath().startsWith(canonicalDest))
    throw new RuntimeException("Zip Slip detected: " + entry.getName());