{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:7421bc33-2716-5100-ac99-e841020e1571",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-integration-zip",
      "purl": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5-tuxcare.2",
      "type": "library",
      "group": "org.springframework.integration",
      "bom-ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5-tuxcare.2",
      "version": "6.1.5-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-integration-zip",
            "purl": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5",
            "type": "library",
            "group": "org.springframework.integration",
            "version": "6.1.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2018-1261",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9b4c6a03-1683-55a0-bc91-11316abf1f40",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1261 does not affect version 6.1.5-tuxcare.2 of org.springframework.integration:spring-integration-zip. not_affected \u2014 The target spring-integration 6.1.5-tuxcare.6 is not affected by CVE-2018-1261. The vulnerability (path traversal in zip extraction) was fixed in the upstream codebase before this version. The spring-integration-zip module contains path traversal protection via the checkPath() method that validates canonical paths, preventing malicious zip entries with \"../\" sequences from escaping the target e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1263",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e6c82b8e-c70a-5f7b-8279-e37347906d83",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1263 does not affect version 6.1.5-tuxcare.2 of org.springframework.integration:spring-integration-zip. not_affected \u2014 CVE-2018-1263 (path traversal in zip extraction) is NOT present in Spring Integration 6.1.5-tuxcare.6. The vulnerability was already fixed in the upstream release before TuxCare onboarded this version. The fix (checkPath() method performing canonical path validation) was present in commit 210a2f9d2c when the spring-integration-zip module was migrated into Spring Integration core in February 202...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-22114",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7122ab75-a3ba-5f65-adc6-754234486e4a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2021-22114 does not affect version 6.1.5-tuxcare.2 of org.springframework.integration:spring-integration-zip. not_affected \u2014 CVE-2021-22114 affects spring-integration-zip < 1.0.4 with a path traversal vulnerability during archive extraction. The target (spring-integration 6.1.5) includes the spring-integration-zip module with path traversal protection already present. The checkPath method validates that extracted files cannot escape the target directory by comparing canonical paths. This fix was already in the upstre...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47862",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:33d0f631-7030-5c4d-9fd9-2fc5ae410e15",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47862 is fixed in version 6.1.5-tuxcare.2 of org.springframework.integration:spring-integration-zip."
      }
    },
    {
      "id": "CVE-2026-59274",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e27d065f-071d-5580-9c09-dcbbee821b46",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59274 is fixed in version 6.1.5-tuxcare.2 of org.springframework.integration:spring-integration-zip."
      }
    },
    {
      "id": "CVE-2026-59311",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0ced9f35-f2ed-5a82-8fbf-412e52ac46a1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59311 is fixed in version 6.1.5-tuxcare.2 of org.springframework.integration:spring-integration-zip."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework.integration/spring-integration-zip@6.1.5-tuxcare.2"
    }
  ]
}