Read the docs
TI-2026-84459 Aliases CVE-2026-63436

Path traversal in zt-zip fluent API unpack lets crafted archives write files

Priority LOW 27CWE-22Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

zt-zip, a Java library for ZIP archive manipulation, is affected before 1.18.0. The fluent API Zips.get(zip).unpack().destination(outputDir).process() builds output file paths from ZIP entry names without the destination boundary check used by ZipUtil.unpack(...), which is a path traversal flaw (CWE-22). An attacker who supplies a crafted archive with parent-directory entry names can write files outside the destination directory, but the attacker needs a victim to process the archive, and the victim must extract untrusted archives through this fluent API. Applications that extract untrusted archives only through ZipUtil.unpack(...) are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.

Why it matters now

EPSS 0.00242 15th percentileScored 2026-11-07
Fix Fixed zt-zip (zeroturnaround): 1.18.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
zeroturnaroundzt-zipbefore 1.18.01.18.0Patch availableCNA
  • zt-zip Vendorzeroturnaround Affected before 1.18.0 Fixed in 1.18.0 Patch available CNA

Remediation

Upgrade zt-zip to version 1.18.0, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA zt-zip (zeroturnaround) Fixed in 1.18.0

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-63436
  2. 2026-11-05 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-84460 ZipUtil.unpack in zt-zip can change output directory permissions CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences