Cpe:2.3:a:zeroturnaround:zt-Zip:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3azeroturnaroundzt-zip/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 22:14:58 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgZeroTurnaround zt-zip: Path traversal vulnerability (CVE-2026-63436)https://feed.craftedsignal.io/briefs/2026-11-zt-zip-path-traversal/Mon, 09 Nov 2026 22:14:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-zt-zip-path-traversal/The zt-zip library fails to validate destination boundaries within its fluent Zips API, allowing arbitrary file writes via path traversal sequences in ZIP entry names.The zt-zip library (prior to 1.18.0) contains a path traversal vulnerability in the Zips fluent API. Unlike the standard ZipUtil.unpack() method, the Zips implementation does not validate that ZIP entry names remain within the configured destination directory. Attackers can leverage ZIP archives containing entries with ../ sequences to write files to arbitrary locations on the filesystem, constrained only by the process's permissions. This issue impacts both the standard unpack flow and transformer-based operations.

Impact

Successful exploitation allows for arbitrary file writes outside the intended extraction path. This can lead to remote code execution or application state manipulation if an attacker can overwrite sensitive configuration files, scripts, or application binaries within the process's effective scope.

Recommendation

  • Update the zt-zip library to version 1.18.0 or later immediately.
  • Review applications using Zips.get(...).unpack().destination(...).process() to confirm if they process untrusted ZIP archives.
  • As an interim measure, ensure the process running the extraction has strictly limited filesystem permissions (Principle of Least Privilege).
]]>highadvisory