The vulnerability resides in the extractTarGZ and extractZip functions of the CommandUtils class in HummerRisk's archive extraction component. By manipulating the path entries inside a submitted archive, an attacker can cause the application to extract files outside the intended directory, resulting in unauthorized file system access. The impact is the ability to read or write arbitrary files on the host, compromising confidentiality, integrity, or availability of the system.

All instances of HummerRisk up to and including version 1.5.0 are affected. The flaw is located in the hummer-common-core module of the application and applies to the Archive Extraction functionality exposed by the web service.

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation at present. This vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote delivery of a crafted archive to the extraction endpoint, which can be performed over the network if the service is exposed. The lack of a public patch from the vendor further increases the risk for existing deployments.