The vulnerability in Lhaz and Lhaz+ arises from improper limitation of pathname during automatic folder creation when extracting archive files. Specifically, if an archive contains filenames crafted to traverse directories, the software may extract files outside the designated extraction folder. This behavior can lead to files being placed in unintended locations, potentially overwriting or adding files where not expected. The issue affects versions 2.6.3 and earlier. The CVSS 3.0 base score is 3.3, reflecting low impact with local attack vector, low complexity, no privileges required, user interaction needed, and limited integrity impact without confidentiality or availability impact. No vendor advisory or patch information is currently available, and the software is not a cloud service.

The impact is limited to potential unauthorized file placement due to path traversal during archive extraction. This could allow an attacker to place files in unexpected directories, which may lead to limited integrity issues. There is no impact on confidentiality or availability. The vulnerability requires local access and user interaction to trigger. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the automatic folder creation feature when extracting archives or carefully validate archive contents before extraction to avoid processing files with crafted filenames that could lead to path traversal.