Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for php-archive by kiwilan

    CVE-2026-112302 (GCVE-0-2026-112302)

    Vulnerability from nvd – Published: 2026-10-19 21:00 – Updated: 2026-10-19 21:00
    VLAI
    Title
    kiwilan php-archive Extraction ArchiveZip.php extract path traversal
    Summary
    A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
    6.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
    CWE
    Assigner
    VulDB CNA under the mitre root
    CNA scorecard B 82/100 over 3990 records in the last 180 days details
    References
    URL Tags
    https://vuldb.com/vuln/422348 vdb-entrytechnical-description
    https://vuldb.com/vuln/422348/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-112302 third-party-advisory
    https://vuldb.com/submit/987582 third-party-advisory
    https://gist.github.com/0xSebin/90d210e703f880d59… exploit
    Impacted products
    Vendor Product Version
    kiwilan php-archive Affected: 2.3.02
        cpe:2.3:a:kiwilan:php-archive:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    0xSebin (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kiwilan:php-archive:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Extraction"
          ],
          "product": "php-archive",
          "vendor": "kiwilan",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.02"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "0xSebin (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T21:00:23.649Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-422348 | kiwilan php-archive Extraction ArchiveZip.php extract path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/422348"
        },
        {
          "name": "VDB-422348 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/422348/cti"
        },
        {
          "name": "CVE-2026-112302 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-112302"
        },
        {
          "name": "Submit #987582 | Kiwilan php-archive 2.3.02 Kiwilan php-archive ArchiveZip.php extract Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/987582"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/0xSebin/90d210e703f880d59dbde243fae3aa75"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-19T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-19T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-19T16:14:21.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "kiwilan php-archive Extraction ArchiveZip.php extract path traversal",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-112302",
    "datePublished": "2026-10-19T21:00:23.649Z",
    "dateReserved": "2026-10-19T14:09:12.443Z",
    "dateUpdated": "2026-10-19T21:00:23.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-112302 (GCVE-0-2026-112302)

    Vulnerability from cvelistv5 – Published: 2026-10-19 21:00 – Updated: 2026-10-19 21:00
    VLAI
    Title
    kiwilan php-archive Extraction ArchiveZip.php extract path traversal
    Summary
    A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    5.3 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
    6.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
    6.3 (Medium)
    CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C
    CWE
    Assigner
    VulDB CNA under the mitre root
    CNA scorecard B 82/100 over 3990 records in the last 180 days details
    References
    URL Tags
    https://vuldb.com/vuln/422348 vdb-entrytechnical-description
    https://vuldb.com/vuln/422348/cti signaturepermissions-required
    https://vuldb.com/cve/CVE-2026-112302 third-party-advisory
    https://vuldb.com/submit/987582 third-party-advisory
    https://gist.github.com/0xSebin/90d210e703f880d59… exploit
    Impacted products
    Vendor Product Version
    kiwilan php-archive Affected: 2.3.02
        cpe:2.3:a:kiwilan:php-archive:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    0xSebin (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:kiwilan:php-archive:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "Extraction"
          ],
          "product": "php-archive",
          "vendor": "kiwilan",
          "versions": [
            {
              "status": "affected",
              "version": "2.3.02"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "0xSebin (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T21:00:23.649Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-422348 | kiwilan php-archive Extraction ArchiveZip.php extract path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/422348"
        },
        {
          "name": "VDB-422348 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/422348/cti"
        },
        {
          "name": "CVE-2026-112302 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-112302"
        },
        {
          "name": "Submit #987582 | Kiwilan php-archive 2.3.02 Kiwilan php-archive ArchiveZip.php extract Path Traversal",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/987582"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/0xSebin/90d210e703f880d59dbde243fae3aa75"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-19T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-10-19T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-10-19T16:14:21.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "kiwilan php-archive Extraction ArchiveZip.php extract path traversal",
      "x_generator": [
        "VulDB PVTS v202610"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-112302",
    "datePublished": "2026-10-19T21:00:23.649Z",
    "dateReserved": "2026-10-19T14:09:12.443Z",
    "dateUpdated": "2026-10-19T21:00:23.649Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}