CVE-2026-3067 | HummerRisk up to 1.5.0 Archive Extraction CommandUtils.java extractTarGZ/extractZip path traversal

A vulnerability was found in HummerRisk up to 1.5.0. It has been rated as critical. This issue affects the function extractTarGZ/extractZip of the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/CommandUtils.java of the component Archive Extraction. The manipulation leads to path traversal.

This vulnerability is uniquely identified as CVE-2026-3067. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.