ZipRarHunter

ZipRarHunter ZipRarHunter is a powerful command-line ethical hacking tool designed to crack passwords of ZIP and RAR archive files using a wordlist.It automates the process of password recovery from encrypted archives Features Cracking ZIP files encrypted with both ZipCrypto and AES-256 encryptio...

CVE-2024-55587

CVE-2024-55587 This repository is proof of concept for CVE-2024-55587 vulnerability in python library libarchive. The generatezip file creates malicious zip that will exploit u safe extraction of files in libarchive extractall method. The vulnerablezip is just an exaple of vulnerable code...

ZipCracker

ZipCracker ZipCracker is a simple but powerful password brute-force utility for cracking password-protected ZIP archives. It’s built with Qt and integrates a custom cracking engine, providing both CLI and GUI support. ⚡ Disclaimer: This tool is intended for educational purposes, recovery of your...

Se7enSlip

🔒 Se7enSlip - 7-Zip Vulnerability Scanner A stunning, interactive web application that demonstrates and helps detect the critical CVE-2023-52169 symlink traversal vulnerability in 7-Zip archives. ⚡ Features 🎯 Core Functionality ZIP Upload & Analysis - Drag & drop or click to upload ZIP files for...

zombieguard

ZombieGuard A defensive scanner for structural metadata evasion in ZIP archives. ZombieGuard detects contradictions between ZIP local file headers, central directory records, and payload characteristics. These contradictions can be used to make archive contents appear empty or harmless to one...

CVE-2026-116137

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

PT-2026-122978

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry or readAsText validates benign content while...

EUVD-2026-101635

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite before ZipArchive::extractTo writes entries into the destination directory. An authenticated user...

EUVD-2026-42295

BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extraction...

CVE-2026-110232

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../x/file to create or overwrite files in sibling folders...

EUVD-2026-99016

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../x/file to create or overwrite files in sibling folders...

CVE-2026-110232 Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../x/file to create or overwrite files in sibling folders...

CVE-2026-110232 Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../x/file to create or overwrite files in sibling folders...

CVE-2026-110232 Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../x/file to create or overwrite files in sibling folders...

CVE-2026-110232

Fossify File Manager versions through 1.6.2 are vulnerable to a path traversal vulnerability (Zip Slip) within the DecompressActivity component. The root cause is an unanchored startsWith check that fails to properly restrict file paths during extraction. An attacker can provide a crafted ZIP arc...

PT-2026-111855

Name of the Vulnerable Software and Affected Versions Fossify File Manager versions prior to 1.6.3 Description A path traversal issue exists where crafted ZIP archives can write files outside the intended extraction folder. This occurs because of an unanchored startsWith check, allowing attackers...

CVE-2026-110232: Improper Limitation of a Pathname to a Restricted Directory

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../ x/file to create or overwrite files in sibling folder...

Arbitrary Code Injection

Grav CMS is vulnerable to Arbitrary Code Injection. The vulnerability is due to insufficient validation of uploaded ZIP archives in the Flex Objects plugin, which allows an authenticated attacker to bypass filename validation, upload malicious PHP files to the web root, and execute arbitrary code...

CVE-2026-92000

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service...

CVE-2026-92000

adm-zip versions 0.5.14 through 0.6.0 are vulnerable to a denial-of-service attack caused by failing to apply zlib decompression output limits when ZIP entries declare a zero uncompressed size . An attacker can craft a malicious ZIP archive containing highly compressible entries that declare zero...