CVE-2021-26719: 
Gradle vulnerability analysis and mitigation

A directory traversal vulnerability (CVE-2021-26719) was discovered in multiple Gradle components: gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and gradle-enterprise-maven-extension versions 1.8 to 1.8.2. The vulnerability was disclosed on February 8, 2021. The issue affects the file transfer functionality between build clients and test execution agents (Gradle Advisory).

The vulnerability exists in the way TAR archives are handled during file transfers between build clients and test execution agents. The unpacking of such archives is susceptible to a "Zip Slip" vulnerability, where maliciously crafted archives could lead to arbitrary file creation or overwriting on the local filesystem. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (NVD).

If exploited, this vulnerability allows an attacker with certain credentials to perform a registration step that enables crafted TAR archives to extract files into arbitrary filesystem locations. This could potentially lead to unauthorized file creation or modification in unintended locations on the system (Gradle Advisory).

The vulnerability can be exploited by a malicious actor in two ways: 1) An attacker with network access and test distribution agent registration credentials could register an alternative agent implementation to send crafted archive files to the build site, or 2) An attacker with network access and test distribution usage credentials could register an alternative client implementation to send crafted archive files to the test execution site (Gradle Advisory).

The vulnerability has been fixed in Test distribution agent version 1.3.2, Gradle plugin 1.3.2, and Maven extension 1.8.2. The fix includes implementing checks to refuse unpacking archive entries containing upward path traversal segments or file system links. Users should upgrade to these versions or later to mitigate the vulnerability (Gradle Advisory).