Ne-Lexa php-zip versions 4.0.0 through 4.0.2 contain a path traversal vulnerability in the ZipFile::extractTo function. This vulnerability arises from improper handling of the entryName argument, allowing an attacker to manipulate file paths during extraction. Exploitation can be performed remotely without privileges or user interaction, potentially allowing unauthorized file write outside the intended extraction directory. The vulnerability was reported early to the project, but no response or fix has been provided yet. The CVSS 4.0 base score is 6.9, indicating medium severity.

Successful exploitation of this vulnerability allows an attacker to perform path traversal during archive extraction, potentially writing files to arbitrary locations on the filesystem. This can lead to unauthorized file overwrite or creation, which may affect system integrity or enable further attacks depending on the environment where php-zip is used.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should consider avoiding use of the affected versions (4.0.0, 4.0.1, 4.0.2) or implement additional controls to validate and sanitize entryName inputs before extraction. Monitor vendor channels for updates or official patches.