4 matches found
CVE-2026-63499
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack... can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal...
CVE-2026-63499
The zt-zip Java library (prior to version 1.18.1 ) contains a vulnerability in ZipUtil.unpack(...) where an attacker can manipulate directory permissions. Because path traversal checks allow self-referencing entries like / or ./, an attacker can craft a ZIP archive that causes the unpacker to app...
CVE-2026-63499 zt-zip: ZipUtil.unpack can change file permissions of output directory
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack... can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal...
EUVD-2026-116113
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack... can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal...