Vendor
IzPack installer fails to validate target paths in UnpackerBase, allowing attackers to overwrite arbitrary files on the system by distributing trojanized, unsigned installer JARs.