Live › vulnerability › CVE-2026-63436
zt-zip is a Java ZIP library whose Zips.get(...).unpack().destination(...).process() API builds output paths from entry names without checking for parent-directory traversal. A crafted archive with entries like ../ can write files outside the chosen output directory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 18:22 UTC. All times on this page are UTC.
Applications that use the Zips fluent unpack API on ZIP archives from untrusted sources are exposed, since a crafted entry name can escape the destination directory. Applications that extract untrusted archives only through ZipUtil.unpack(...) are not affected, because that method already checks for traversal. Build tools and internal code that only handle trusted archives are lower risk.
No product ranges from the sources yet.
mvn dependency:tree or gradle dependencies.Zips.get( followed by .unpack() to see whether untrusted archives go through the fluent API rather than ZipUtil.unpack(...).1.18.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-63436")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.