{"id":"CVE-2026-112302","kind":"vulnerability","aliases":["CVE-2026-112302"],"related":[],"title":"php-archive: zip extraction path traversal lets attackers write outside target folder","description":"A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"kiwilan php-archive up to 2.3.02 has a path traversal flaw in ArchiveZip::extract, which unpacks ZIP files. A remote attacker can supply a crafted archive whose entries escape the extraction directory and write files to arbitrary locations.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["composer","file-upload","package","php"],"not_affected_if":["extract-not-used","no-untrusted-archives"],"how_to_check":"- Check the installed version with `composer show kiwilan/php-archive` and see whether it is `2.3.02` or older.\n- Search application code for calls to `ArchiveZip::extract` or `extract(` on uploaded or remote ZIP files.","fix":"- Upgrade kiwilan/php-archive to a release newer than `2.3.02`; the sources do not name a fixed version.\n- Until patched, validate every entry path in uploaded ZIP files and reject entries containing `..` or absolute paths, or stop extracting untrusted archives.","status":"open","published_at":"2026-10-19T21:17:07+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:22:52+00:00","updated_at":"2026-10-25T03:22:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:22:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade kiwilan/php-archive to a release newer than `2.3.02`; the sources do not name a fixed version.\n- Until patched, validate every entry path in uploaded ZIP files and reject entries containing `..` or absolute paths, or stop extracting untrusted archives.","reach":"internet","title":"php-archive: zip extraction path traversal lets attackers write outside target folder","impact":"high","summary":"kiwilan php-archive up to 2.3.02 has a path traversal flaw in ArchiveZip::extract, which unpacks ZIP files. A remote attacker can supply a crafted archive whose entries escape the extraction directory and write files to arbitrary locations.","category":"package","nicknames":[],"who_cares":["php","composer","file-upload"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker writes files outside the extraction directory, possibly overwriting application code","analyst_note":"Confirm the patched version and whether a fix exists; the vendor did not respond, so check the GitHub repository and NVD references for a fixed release.","how_to_check":"- Check the installed version with `composer show kiwilan/php-archive` and see whether it is `2.3.02` or older.\n- Search application code for calls to `ArchiveZip::extract` or `extract(` on uploaded or remote ZIP files.","needs_analyst":true,"not_affected_if":["no-untrusted-archives","extract-not-used"],"who_is_affected":"Applications that use kiwilan/php-archive to extract ZIP files that come from users or other untrusted sources are exposed, because a malicious archive can place files outside the intended directory. Systems that only read archives you create yourself, or never call the extract path, are less exposed. The sources do not say whether a specific default configuration is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3344,"output_tokens":655,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112302':16A,19A '-2026':15A,18A '2.3.02':32B,77C 'affect':79C 'arbitrari':63B 'archiv':3A,29B,52B,74C 'archivezip':39B,82C 'attack':9A,47B,98C,120C 'avail':111C 'carri':103C 'caus':94C 'compon':90C 'compos':20B 'contact':124C 'could':116C 'craft':51B 'cve':14A,17A 'directori':58B 'disclosur':128C 'earli':125C 'entri':54B 'escap':55B 'exploit':107C 'extract':5A,40B,57B,83C,91C 'file':22B,44B,61B,86C 'file-upload':21B 'flaw':37B 'folder':13A 'function':81C 'identifi':69C 'kiwilan':26B,71C 'let':8A 'locat':64B 'made':110C 'manipul':93C 'outsid':11A 'packag':24B 'path':6A,35B,95C 'php':2A,25B,28B,73C 'php-archiv':1A,27B,72C 'possibl':100C 'public':114C 'remot':46B,105C 'respond':132C 'src/readers/archivezip.php':87C 'suppli':49B 'target':12A 'travers':7A,36B,96C 'unpack':42B 'upload':23B 'use':118C 'vendor':122C 'way':135C 'weak':66C 'whose':53B 'write':10A,60B 'zip':4A,43B","nicknames":[],"mitigations":[],"who_affected":"Applications that use kiwilan/php-archive to extract ZIP files that come from users or other untrusted sources are exposed, because a malicious archive can place files outside the intended directory. Systems that only read archives you create yourself, or never call the extract path, are less exposed. The sources do not say whether a specific default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T21:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112302","severity":null,"published_at":"2026-10-19T21:17:07+00:00","modified_at":"2026-10-22T21:17:15+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}