CVE-2026-63436

The zt-zip Java library is vulnerable to a path traversal flaw in versions prior to 1.18.0 . The Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java fails to apply destination-boundary validation. This allows a crafted ZIP entry wit...