Threats tagged 'ghsa-52c6-99qm-3hqr'

A path traversal vulnerability exists in the org.zeroturnaround:zt-zip library's fluent API unpack method (CVE-2026-63436). The Zips fluent API does not properly validate ZIP entry paths, allowing entries with '../' sequences to write files outside the intended extraction directory. This can lead to arbitrary file writes outside the target directory when unpacking attacker-controlled ZIP files. The issue affects versions prior to 1.18.0 and is fixed in version 1.18.0.