Read the docs
TI-2021-04786 Aliases CVE-2021-21706GHSA-x4g4-47f7-vvq4

ZipArchive::extractTo may extract outside of destination dir

Priority LOW 32CWE-24Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Why it matters now

EPSS 0.01517 74th percentileScored 2026-11-07
Fix Fixed PHP (PHP Group): 7.3.31, 7.4.24, 8.0.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP GroupPHP7.3.x to before 7.3.31; 7.4.x to before 7.4.24; 8.0.X to before 8.0.117.3.31, 7.4.24, 8.0.11Patch availableCNA
  • PHP VendorPHP Group Affected 7.3.x to before 7.3.31; 7.4.x to before 7.4.24; 8.0.X to before 8.0.11 Fixed in 7.3.31, 7.4.24, 8.0.11 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*7.3.0 to before 7.3.31; 7.4.0 to before 7.4.24; 8.0.0 to before 8.0.11VulnerablePHP
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Versions 7.3.0 to before 7.3.31; 7.4.0 to before 7.4.24; 8.0.0 to before 8.0.11 Vulnerable ·PHP
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA PHP (PHP Group) Fixed in 7.3.31, 7.4.24, 8.0.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21706
  2. 2026-10-03 Alias added: GHSA-x4g4-47f7-vvq4

References

Patch 1

Advisory 1

  • TI-2024-04260 Argument Injection in PHP-CGI KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-78794 PHP remote code execution via stale global state KEVCVSS 4.0CRITICAL 9.2
  • TI-2026-78793 Out-of-memory handling flaw in PHP allows remote code execution KEVCVSS 4.0CRITICAL 9.2
  • TI-2024-01743 Command injection via array-ish $command parameter of proc_open() CVSS 3.1CRITICAL 9.4
  • TI-2022-13555 PDO::quote() may return unquoted string CVSS 3.1CRITICAL 9.1
  • TI-2024-10408 Reference counting in php_request_shutdown causes Use-After-Free CVSS 4.0CRITICAL 9.2
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences