CVE-2026-63436

The zt-zip Java library is vulnerable to a path traversal flaw in versions prior to 1.18.0 . The Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java fails to apply destination-boundary validation. This allows a crafted ZIP entry wit...

EUVD-2026-116112

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.getzip.unpack.destinationoutputDir.process fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the...

CVE-2026-63436 zt-zip: Path traversal in fluent API unpack

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.getzip.unpack.destinationoutputDir.process fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the...