CVE-2026-112302: Path Traversal in kiwilan php-archive

The vulnerability CVE-2026-112302 exists in kiwilan php-archive versions up to and including 2.3.02. It is a path traversal flaw in the ArchiveZip::extract function of the Extraction component, specifically in the src/Readers/ArchiveZip.php file. This flaw allows remote attackers to manipulate file paths during archive extraction, potentially enabling them to write files outside the intended extraction directory. The vulnerability is remotely exploitable without privileges or user interaction, and an exploit has been publicly disclosed. The vendor was contacted but did not respond or issue a patch.

Successful exploitation of this vulnerability could allow an attacker to write files to arbitrary locations on the affected system by manipulating archive extraction paths. This could lead to unauthorized file overwrite or disclosure, potentially compromising system integrity or confidentiality. The CVSS score of 5.3 reflects a medium impact with low attack complexity and no required privileges, but limited scope and impact on confidentiality, integrity, and availability.

No official fix or patch is currently available from the vendor, as they have not responded to the disclosure. Users should avoid using vulnerable versions of kiwilan php-archive (version 2.3.02) until a patch is released. As a temporary mitigation, restrict archive extraction to trusted sources only and consider sandboxing or isolating the extraction process to limit potential damage from path traversal attacks. Monitor vendor channels for updates or patches.