---
id: "CVE-2026-112302"
kind: "vulnerability"
aliases: ["CVE-2026-112302"]
title: "php-archive: zip extraction path traversal lets attackers write outside target folder"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["composer", "file-upload", "package", "php"]
not_affected_if: ["extract-not-used", "no-untrusted-archives"]
published_at: "2026-10-19T21:17:07+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T03:22:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112302", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# php-archive: zip extraction path traversal lets attackers write outside target folder

kiwilan php-archive up to 2.3.02 has a path traversal flaw in ArchiveZip::extract, which unpacks ZIP files. A remote attacker can supply a crafted archive whose entries escape the extraction directory and write files to arbitrary locations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `composer show kiwilan/php-archive` and see whether it is `2.3.02` or older.
- Search application code for calls to `ArchiveZip::extract` or `extract(` on uploaded or remote ZIP files.

## Fix

- Upgrade kiwilan/php-archive to a release newer than `2.3.02`; the sources do not name a fixed version.
- Until patched, validate every entry path in uploaded ZIP files and reject entries containing `..` or absolute paths, or stop extracting untrusted archives.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112302

## From the sources

A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_