Live › vulnerability › CVE-2026-112302
Go to dashboardkiwilan php-archive up to 2.3.02 has a path traversal flaw in ArchiveZip::extract, which unpacks ZIP files. A remote attacker can supply a crafted archive whose entries escape the extraction directory and write files to arbitrary locations.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use kiwilan/php-archive to extract ZIP files that come from users or other untrusted sources are exposed, because a malicious archive can place files outside the intended directory. Systems that only read archives you create yourself, or never call the extract path, are less exposed. The sources do not say whether a specific default configuration is required.
No product ranges from the sources yet.
composer show kiwilan/php-archive and see whether it is 2.3.02 or older.ArchiveZip::extract or extract( on uploaded or remote ZIP files.2.3.02; the sources do not name a fixed version... or absolute paths, or stop extracting untrusted archives.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-112302")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.