{"id":"CVE-2026-63436","kind":"vulnerability","aliases":["CVE-2026-63436"],"related":[],"title":"zt-zip: Zips fluent unpack API allows writing files outside destination","description":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.","summary":"zt-zip is a Java ZIP library whose Zips.get(...).unpack().destination(...).process() API builds output paths from entry names without checking for parent-directory traversal. A crafted archive with entries like ../ can write files outside the chosen output directory.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","package","zip-extraction","zt-zip"],"not_affected_if":["trusted-archives-only","uses-ziputil-unpack-only"],"how_to_check":"- Check whether the project depends on zt-zip and which version is resolved, for example with `mvn dependency:tree` or `gradle dependencies`.\n- Search the code for `Zips.get(` followed by `.unpack()` to see whether untrusted archives go through the fluent API rather than `ZipUtil.unpack(...)`.","fix":"- zt-zip: move to `1.18.0`","status":"open","published_at":"2026-11-03T18:18:03+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","triaged_at":"2026-11-03T18:22:37+00:00","updated_at":"2026-11-03T18:22:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T18:22:37Z","model":"claude-haiku-5-5","output":{"fix":"- zt-zip: move to `1.18.0`","reach":"unknown","title":"zt-zip: Zips fluent unpack API allows writing files outside destination","impact":"medium","summary":"zt-zip is a Java ZIP library whose Zips.get(...).unpack().destination(...).process() API builds output paths from entry names without checking for parent-directory traversal. A crafted archive with entries like ../ can write files outside the chosen output directory.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","zt-zip","zip-extraction"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker overwrites files outside the output directory on the server","analyst_note":"","how_to_check":"- Check whether the project depends on zt-zip and which version is resolved, for example with `mvn dependency:tree` or `gradle dependencies`.\n- Search the code for `Zips.get(` followed by `.unpack()` to see whether untrusted archives go through the fluent API rather than `ZipUtil.unpack(...)`.","plain_action":"","needs_analyst":false,"not_affected_if":["uses-zipUtil-unpack-only","trusted-archives-only"],"who_is_affected":"Applications that use the Zips fluent unpack API on ZIP archives from untrusted sources are exposed, since a crafted entry name can escape the destination directory. Applications that extract untrusted archives only through ZipUtil.unpack(...) are not affected, because that method already checks for traversal. Build tools and internal code that only handle trusted archives are lower risk.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4314,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-63436':15A,18A '1.18.0':85C,160C 'allow':8A 'alreadi':151C 'api':7A,40B,94C,150C 'appli':106C 'applic':138C 'archiv':56B,81C,142C 'boundari':110C 'branch':133C,137C 'build':41B 'call':152C 'check':48B 'checkdestinationfilefortravers':153C 'chosen':65B 'construct':97C 'contain':118C 'conveni':77C 'copi':132C 'craft':55B,116C 'cve':13A,16A 'destin':12A,38B,90C,109C 'destination-boundari':108C 'direct':100C 'directori':52B,67B,121C 'entri':45B,58B,103C,117C 'extract':23B,140C 'file':10A,62B,99C 'fix':157C 'fluent':5A,93C 'issu':155C 'java':19B,32B,73C 'librari':34B,74C 'like':59B 'manipul':82C 'method':78C 'name':46B,104C 'normal':131C 'output':42B,66B,98C 'outputdir':91C,127C 'outsid':11A,63B,126C 'packag':20B 'parent':51B,120C 'parent-directori':50B,119C 'path':43B 'prior':83C 'process':39B,92C 'provid':76C 'src/main/java/org/zeroturnaround/zip/zips.java':96C 'therefor':124C 'travers':53B,122C 'unaffect':147C 'unpack':6A,37B,89C 'untrust':141C 'use':112C 'valid':111C 'version':159C 'whose':35B 'without':47B,105C 'write':9A,61B,125C 'zip':3A,4A,22B,26B,29B,33B,70C,80C,88C,102C 'zip-extract':21B 'zipentrytransform':136C 'zips.get':36B,87C 'ziputil.unpack':114C,145C 'zt':2A,25B,28B,69C 'zt-zip':1A,24B,27B,68C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Zips fluent unpack API on ZIP archives from untrusted sources are exposed, since a crafted entry name can escape the destination directory. Applications that extract untrusted archives only through ZipUtil.unpack(...) are not affected, because that method already checks for traversal. Build tools and internal code that only handle trusted archives are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","medium","package","zipextraction","ztzip"],"campaign_type":null,"first_public_at":"2026-07-01T06:21:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63436","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63436","severity":null,"published_at":"2026-11-03T18:18:03+00:00","modified_at":"2026-11-03T18:18:03+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","fetched_at":"2026-11-03T18:22:10+00:00","note":null}],"documents":[{"id":59667,"url":"https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59668,"url":"https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":59669,"url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-01T06:21:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}