{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/zt-zip--1.18.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zeroturnaround:zt-zip:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":6.1,"id":"CVE-2026-63436"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["zt-zip (\u003c 1.18.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ZeroTurnaround"],"content_html":"\u003cp\u003eThe zt-zip library (prior to 1.18.0) contains a path traversal vulnerability in the \u003ccode\u003eZips\u003c/code\u003e fluent API. Unlike the standard \u003ccode\u003eZipUtil.unpack()\u003c/code\u003e method, the \u003ccode\u003eZips\u003c/code\u003e implementation does not validate that ZIP entry names remain within the configured destination directory. Attackers can leverage ZIP archives containing entries with \u003ccode\u003e../\u003c/code\u003e sequences to write files to arbitrary locations on the filesystem, constrained only by the process's permissions. This issue impacts both the standard unpack flow and transformer-based operations.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file writes outside the intended extraction path. This can lead to remote code execution or application state manipulation if an attacker can overwrite sensitive configuration files, scripts, or application binaries within the process's effective scope.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u003ccode\u003ezt-zip\u003c/code\u003e library to version 1.18.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview applications using \u003ccode\u003eZips.get(...).unpack().destination(...).process()\u003c/code\u003e to confirm if they process untrusted ZIP archives.\u003c/li\u003e\n\u003cli\u003eAs an interim measure, ensure the process running the extraction has strictly limited filesystem permissions (Principle of Least Privilege).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T22:14:58Z","date_published":"2026-11-09T22:14:58Z","id":"https://feed.craftedsignal.io/briefs/2026-11-zt-zip-path-traversal/","summary":"The zt-zip library fails to validate destination boundaries within its fluent Zips API, allowing arbitrary file writes via path traversal sequences in ZIP entry names.","title":"ZeroTurnaround zt-zip: Path traversal vulnerability (CVE-2026-63436)","url":"https://feed.craftedsignal.io/briefs/2026-11-zt-zip-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Zt-Zip (\u003c 1.18.0)","version":"https://jsonfeed.org/version/1.1"}