A vulnerability was discovered in the Shadow plugin for Gradle, a tool for creating shadow JARs. The issue arises from the plugin's reliance on Gradle's ZipFileTree for entry sanitization, which does not validate or sanitize ZIP entry names. This allows malicious upstream dependencies to include path traversal sequences, enabling an attacker to inject malicious entries into the output JAR. The vulnerability affects Gradle versions 7.6.2 and 8.x up to 8.2.0, making users directly exploitable. The issue also compromises downstream consumers who use unprotected extraction or older CI tooling, potentially allowing arbitrary file overwrites.