ZeroTurnaround zt-zip: Path traversal vulnerability (CVE-2026-63436)

The zt-zip library (prior to 1.18.0) contains a path traversal vulnerability in the Zips fluent API. Unlike the standard ZipUtil.unpack() method, the Zips implementation does not validate that ZIP entry names remain within the configured destination directory. Attackers can leverage ZIP archives containing entries with ../ sequences to write files to arbitrary locations on the filesystem, constrained only by the process's permissions. This issue impacts both the standard unpack flow and transformer-based operations.

Impact

Successful exploitation allows for arbitrary file writes outside the intended extraction path. This can lead to remote code execution or application state manipulation if an attacker can overwrite sensitive configuration files, scripts, or application binaries within the process's effective scope.

Recommendation

• Update the zt-zip library to version 1.18.0 or later immediately.
• Review applications using Zips.get(...).unpack().destination(...).process() to confirm if they process untrusted ZIP archives.
• As an interim measure, ensure the process running the extraction has strictly limited filesystem permissions (Principle of Least Privilege).