Ne-Lexa php-zip versions 4.0.0 through 4.0.2 contain a path traversal vulnerability in the ZipFile::extractTo function located in src/ZipFile.php. By manipulating the entryName argument, an attacker can cause the extraction process to write files outside the intended directory, potentially overwriting arbitrary files on the system. This vulnerability is remotely exploitable without requiring privileges or user interaction. The vulnerability was publicly disclosed with an exploit available, but no official fix or mitigation guidance has been provided by the vendor as of the publication date.

Successful exploitation of this vulnerability allows an attacker to perform path traversal during ZIP extraction, which can lead to arbitrary file overwrite on the target system. This can compromise system integrity and potentially lead to further attacks depending on the files overwritten. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, no known exploits in the wild have been reported yet.

As of the current information, no official patch or remediation is available from the vendor. Users should monitor the vendor's advisories for updates and consider applying manual mitigations such as validating and sanitizing entryName inputs before extraction or restricting extraction to safe directories. Avoid using affected versions (4.0.0, 4.0.1, 4.0.2) in production environments until a fix is released.