CVE-2020-35460: 
Java vulnerability analysis and mitigation

CVE-2020-35460 affects common/InputStreamHelper.java in Packwood MPXJ before version 8.3.5. The vulnerability allows directory traversal in the zip stream handler flow, which can lead to the writing of files to arbitrary locations. The vulnerability was discovered and disclosed in December 2020 (NVD).

The vulnerability is classified as a Path Traversal issue (CWE-22) that allows attackers to write files to arbitrary locations through the zip stream handler flow. It has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating it is network accessible, requires low attack complexity, and needs no privileges or user interaction to exploit (NVD).

If exploited, the vulnerability allows attackers to write files to arbitrary locations on the system through the zip stream handler functionality. This could potentially lead to unauthorized file system access and manipulation (NVD).

The vulnerability is remotely exploitable without requiring authentication. It affects the zip stream handler flow in the InputStreamHelper.java component, allowing attackers to manipulate file paths during zip file processing (NVD).

The vulnerability was patched in MPXJ version 8.3.5. The fix includes additional validation of file paths during zip stream processing to prevent directory traversal attacks. Users are recommended to upgrade to version 8.3.5 or later to address this security issue (MPXJ Changes, GitHub Patch).