{"action":"Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.utilities to 5.6.106 or later.","affected":[{"fixed":"5.6.106","introduced":"0"}],"component":"ca.uhn.hapi.fhir:org.hl7.fhir.utilities","cve_ids":["CVE-2023-28465"],"ecosystem":"Maven","epss":0.013,"exploited":false,"fixed_versions":["5.6.106"],"ghsa_id":"GHSA-9654-pr4f-gh6m","id":"tcs_01M5N8P9CQ6D41FQS2SPH7DZA7","modified_at":"2026-07-08T06:29:15.854257898Z","published_at":"2023-03-10T22:15:55Z","references":["https://osv.dev/vulnerability/GHSA-9654-pr4f-gh6m","https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-9654-pr4f-gh6m","https://nvd.nist.gov/vuln/detail/CVE-2023-28465","https://github.com/hapifhir/org.hl7.fhir.core/pull/1162","https://github.com/advisories/GHSA-9654-pr4f-gh6m","https://github.com/hapifhir/org.hl7.fhir.core","https://github.com/hapifhir/org.hl7.fhir.core/blob/b0daf666725fa14476d147522155af1e81922aac/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/terminologies/TerminologyCacheManager.java#L99-L105","https://github.com/hapifhir/org.hl7.fhir.core/releases/tag/5.6.106","https://www.smilecdr.com/our-blog","https://www.smilecdr.com/our-blog/statement-on-cve-2023-24057-smile-digital-health"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-9654-pr4f-gh6m#Maven/ca.uhn.hapi.fhir:org.hl7.fhir.utilities","url":"https://osv.dev/vulnerability/GHSA-9654-pr4f-gh6m"}],"summary":"HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057"}