CVE-2023-35946

CVE-2023-35946 is a path traversal vulnerability in Gradle, a build automation tool. It allows an attacker to write files into unintended locations, either outside the dependency cache or overwriting existing files within it, by crafting malicious dependency coordinates. The CVSS score is 5.5 (Medium), indicating a local attack vector with low complexity, requiring user privileges, and resulting in high impact to integrity but no confidentiality or availability impact. While there is no evidence of active exploitation, public exploit code, or significant community discussion, upgrading to Gradle 7.6.2 or 8.2 is recommended, or enabling dependency verification as a mitigation.