Search
Find a vulnerability
Search criteria
6 vulnerabilities by zeroturnaround
CVE-2026-63499 (GCVE-0-2026-63499)
Vulnerability from nvd – Published: 2026-11-03 18:04 – Updated: 2026-11-03 19:38
VLAI
EPSS
VEX
Title
zt-zip: ZipUtil.unpack can change file permissions of output directory
Summary
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 19:38 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zeroturnaround/zt-zip/security… | x_refsource_CONFIRM |
| https://github.com/zeroturnaround/zt-zip/pull/191 | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/commit/1… | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zeroturnaround | zt-zip |
Affected:
< 1.18.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63499",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T19:38:07.051046Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:38:28.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zt-zip",
"vendor": "zeroturnaround",
"versions": [
{
"status": "affected",
"version": "\u003c 1.18.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker\u0027s permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:04:46.843Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/pull/191",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/pull/191"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1"
}
],
"source": {
"advisory": "GHSA-v2g6-7r9j-v6px",
"discovery": "UNKNOWN"
},
"title": "zt-zip: ZipUtil.unpack can change file permissions of output directory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63499",
"datePublished": "2026-11-03T18:04:46.843Z",
"dateReserved": "2026-07-16T21:49:52.069Z",
"dateUpdated": "2026-11-03T19:38:28.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63436 (GCVE-0-2026-63436)
Vulnerability from nvd – Published: 2026-11-03 18:02 – Updated: 2026-11-03 18:02
VLAI
EPSS
VEX
Title
zt-zip: Path traversal in fluent API unpack
Summary
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.
Severity
6.1 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zeroturnaround/zt-zip/security… | x_refsource_CONFIRM |
| https://github.com/zeroturnaround/zt-zip/pull/180 | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/commit/5… | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zeroturnaround | zt-zip |
Affected:
< 1.18.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "zt-zip",
"vendor": "zeroturnaround",
"versions": [
{
"status": "affected",
"version": "\u003c 1.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:02:27.180Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/pull/180",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/pull/180"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0"
}
],
"source": {
"advisory": "GHSA-52c6-99qm-3hqr",
"discovery": "UNKNOWN"
},
"title": "zt-zip: Path traversal in fluent API unpack"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63436",
"datePublished": "2026-11-03T18:02:27.180Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-11-03T18:02:27.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2018-1002201 (GCVE-0-2018-1002201)
Vulnerability from nvd – Published: 2018-07-25 17:00 – Updated: 2024-09-16 19:14
VLAI
EPSS
VEX
Summary
zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Severity
No CVSS data available.
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://snyk.io/research/zip-slip-vulnerability | x_refsource_MISC |
| https://github.com/snyk/zip-slip-vulnerability | x_refsource_MISC |
| https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681 | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/blob/zt-… | x_refsource_CONFIRM |
| https://github.com/zeroturnaround/zt-zip/commit/7… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zeroturnaround | zt-zip |
Affected:
unspecified , < 1.13
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:47:57.595Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://snyk.io/research/zip-slip-vulnerability"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/snyk/zip-slip-vulnerability"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "zt-zip",
"vendor": "zeroturnaround",
"versions": [
{
"lessThan": "1.13",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2018-05-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as \u0027Zip-Slip\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-25T17:00:00.000Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://snyk.io/research/zip-slip-vulnerability"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/snyk/zip-slip-vulnerability"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "report@snyk.io",
"DATE_ASSIGNED": "2018-05-17T10:52Z",
"ID": "CVE-2018-1002201",
"REQUESTER": "danny@snyk.io",
"STATE": "PUBLIC",
"UPDATED": "2018-05-17T10:52Z"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "zt-zip",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "1.13"
}
]
}
}
]
},
"vendor_name": "zeroturnaround"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as \u0027Zip-Slip\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://snyk.io/research/zip-slip-vulnerability",
"refsource": "MISC",
"url": "https://snyk.io/research/zip-slip-vulnerability"
},
{
"name": "https://github.com/snyk/zip-slip-vulnerability",
"refsource": "MISC",
"url": "https://github.com/snyk/zip-slip-vulnerability"
},
{
"name": "https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681",
"refsource": "MISC",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt",
"refsource": "CONFIRM",
"url": "https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff",
"refsource": "CONFIRM",
"url": "https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2018-1002201",
"datePublished": "2018-07-25T17:00:00.000Z",
"dateReserved": "2018-07-25T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:14:30.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-63499 (GCVE-0-2026-63499)
Vulnerability from cvelistv5 – Published: 2026-11-03 18:04 – Updated: 2026-11-03 19:38
VLAI
EPSS
VEX
Title
zt-zip: ZipUtil.unpack can change file permissions of output directory
Summary
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 19:38 UTC
CWE
- CWE-23 - Relative Path Traversal
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zeroturnaround/zt-zip/security… | x_refsource_CONFIRM |
| https://github.com/zeroturnaround/zt-zip/pull/191 | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/commit/1… | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zeroturnaround | zt-zip |
Affected:
< 1.18.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63499",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T19:38:07.051046Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:38:28.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zt-zip",
"vendor": "zeroturnaround",
"versions": [
{
"status": "affected",
"version": "\u003c 1.18.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker\u0027s permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23: Relative Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:04:46.843Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/pull/191",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/pull/191"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1"
}
],
"source": {
"advisory": "GHSA-v2g6-7r9j-v6px",
"discovery": "UNKNOWN"
},
"title": "zt-zip: ZipUtil.unpack can change file permissions of output directory"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63499",
"datePublished": "2026-11-03T18:04:46.843Z",
"dateReserved": "2026-07-16T21:49:52.069Z",
"dateUpdated": "2026-11-03T19:38:28.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63436 (GCVE-0-2026-63436)
Vulnerability from cvelistv5 – Published: 2026-11-03 18:02 – Updated: 2026-11-03 18:02
VLAI
EPSS
VEX
Title
zt-zip: Path traversal in fluent API unpack
Summary
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.
Severity
6.1 (Medium)
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/zeroturnaround/zt-zip/security… | x_refsource_CONFIRM |
| https://github.com/zeroturnaround/zt-zip/pull/180 | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/commit/5… | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/releases… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zeroturnaround | zt-zip |
Affected:
< 1.18.0
|
{
"containers": {
"cna": {
"affected": [
{
"product": "zt-zip",
"vendor": "zeroturnaround",
"versions": [
{
"status": "affected",
"version": "\u003c 1.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:02:27.180Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/pull/180",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/pull/180"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0"
}
],
"source": {
"advisory": "GHSA-52c6-99qm-3hqr",
"discovery": "UNKNOWN"
},
"title": "zt-zip: Path traversal in fluent API unpack"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63436",
"datePublished": "2026-11-03T18:02:27.180Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-11-03T18:02:27.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2018-1002201 (GCVE-0-2018-1002201)
Vulnerability from cvelistv5 – Published: 2018-07-25 17:00 – Updated: 2024-09-16 19:14
VLAI
EPSS
VEX
Summary
zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Severity
No CVSS data available.
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://snyk.io/research/zip-slip-vulnerability | x_refsource_MISC |
| https://github.com/snyk/zip-slip-vulnerability | x_refsource_MISC |
| https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681 | x_refsource_MISC |
| https://github.com/zeroturnaround/zt-zip/blob/zt-… | x_refsource_CONFIRM |
| https://github.com/zeroturnaround/zt-zip/commit/7… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| zeroturnaround | zt-zip |
Affected:
unspecified , < 1.13
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:47:57.595Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://snyk.io/research/zip-slip-vulnerability"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/snyk/zip-slip-vulnerability"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "zt-zip",
"vendor": "zeroturnaround",
"versions": [
{
"lessThan": "1.13",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"dateAssigned": "2018-05-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as \u0027Zip-Slip\u0027."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-07-25T17:00:00.000Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://snyk.io/research/zip-slip-vulnerability"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/snyk/zip-slip-vulnerability"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "report@snyk.io",
"DATE_ASSIGNED": "2018-05-17T10:52Z",
"ID": "CVE-2018-1002201",
"REQUESTER": "danny@snyk.io",
"STATE": "PUBLIC",
"UPDATED": "2018-05-17T10:52Z"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "zt-zip",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_value": "1.13"
}
]
}
}
]
},
"vendor_name": "zeroturnaround"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as \u0027Zip-Slip\u0027."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://snyk.io/research/zip-slip-vulnerability",
"refsource": "MISC",
"url": "https://snyk.io/research/zip-slip-vulnerability"
},
{
"name": "https://github.com/snyk/zip-slip-vulnerability",
"refsource": "MISC",
"url": "https://github.com/snyk/zip-slip-vulnerability"
},
{
"name": "https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681",
"refsource": "MISC",
"url": "https://snyk.io/vuln/SNYK-JAVA-ORGZEROTURNAROUND-31681"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt",
"refsource": "CONFIRM",
"url": "https://github.com/zeroturnaround/zt-zip/blob/zt-zip-1.13/Changelog.txt"
},
{
"name": "https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff",
"refsource": "CONFIRM",
"url": "https://github.com/zeroturnaround/zt-zip/commit/759b72f33bc8f4d69f84f09fcb7f010ad45d6fff"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2018-1002201",
"datePublished": "2018-07-25T17:00:00.000Z",
"dateReserved": "2018-07-25T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:14:30.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}