GHSA-hvp5-5x4f-33fq: 
Java vulnerability analysis and mitigation

A file override vulnerability was discovered in JADX (GHSA-hvp5-5x4f-33fq), affecting versions prior to 1.5.0. The vulnerability occurs when JADX parses resource files, specifically involving an escape problem with style files that can lead to overwriting other files in the directory when saving decompile results (GitHub Advisory).

The vulnerability stems from JADX's handling of resource files, particularly in the getResAlias function's processing of filenames. When processing style-type files, the original filename is returned directly without proper sanitization. The vulnerability has been assigned a CVSS score of 3.3 (Low severity) with the following vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue is classified under CWE-22, indicating a path traversal weakness (GitHub Advisory).

The vulnerability allows an attacker to potentially overwrite files within the directory where decompile results are saved. While the impact is limited to the local system and requires low privileges, it could affect file integrity in the target directory (GitHub Advisory).

The vulnerability has been patched in JADX version 1.5.0. The fix includes implementing checks to ignore resource table entries containing '../' in their names and improving the validation of ZIP entry names (GitHub Commit).