HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive (for a prepackaged terminology cache, NPM package, or comparison archive).

Affected: Maven: ca.uhn.hapi.fhir:org.hl7.fhir.core, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.convertors, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r4b, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.r5, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.utilities, Maven: ca.uhn.hapi.fhir:org.hl7.fhir.validation

### Impact

MITM can enable Zip-Slip.

### Vulnerability

#### Vulnerability 1: `Scanner.java`

There is no validation that the zip file being unpacked has entries that are not maliciously writing outside of the intended destination directory. https://github.com/hapifhir/org.hl7.fhir.core/blob/8c43e21094af971303131efd081503e5a112db4b/org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java#L335-L357

This zip archive is downloaded over HTTP instead of HTTPS, leaving it vulnerable to compromise in-flight. https://github.com/hapifhir/org.hl7.fhir.core/blob/8c43e21094af971303131efd081503e5a112db4b/org.hl7.fhir.validation/src/main/java/org/hl7/fhir/validation/Scanner.java#L136

##### Vulnerability 2: `TerminologyCacheManager.java`

**Note:** While these links point to only one implementation, both implementations of `TerminologyCacheManager.java` are vulnerable to this as their code seems to be duplicated. - https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.r5/src/main/java/org/hl7/fhir/r5/terminologies/TerminologyCacheManager.java - https://github.com/hapifhir/org.hl7.fhir.core/blob/f58b7acfb5e393cac52cc5bbb170bdb669c2880e/org.hl7.fhir.r4b/src/main/java/org/hl7/fhir/r4b/terminologies/TerminologyCacheManager.java

While there is validation in this bit of logic that attempts to validate that the zip file doesn't contain malicious entries that escape the destination directory, the guard is insufficient.

ht…