In Spring Cloud Data Flow versions prior to 2.11.4, a malicious user who has access to the Skipper server api can use a crafted upload request to write an arbitrary file to any location on the file system which could lead to compromising the server
{ "nvd_published_at": "2024-07-25T10:15:07Z", "cwe_ids": [ "CWE-22", "CWE-94" ], "severity": "CRITICAL", "github_reviewed": true, "github_reviewed_at": "2024-07-25T15:19:46Z" }