---
id: "CVE-2026-63436"
kind: "vulnerability"
aliases: ["CVE-2026-63436"]
title: "zt-zip: Zips fluent unpack API allows writing files outside destination"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "package", "zip-extraction", "zt-zip"]
not_affected_if: ["trusted-archives-only", "uses-ziputil-unpack-only"]
published_at: "2026-11-03T18:18:03+00:00"
first_seen_at: "2026-11-03T18:22:10+00:00"
updated_at: "2026-11-03T18:22:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63436", "first_seen_at": "2026-11-03T18:22:10+00:00"}]
---

# zt-zip: Zips fluent unpack API allows writing files outside destination

zt-zip is a Java ZIP library whose Zips.get(...).unpack().destination(...).process() API builds output paths from entry names without checking for parent-directory traversal. A crafted archive with entries like ../ can write files outside the chosen output directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project depends on zt-zip and which version is resolved, for example with `mvn dependency:tree` or `gradle dependencies`.
- Search the code for `Zips.get(` followed by `.unpack()` to see whether untrusted archives go through the fluent API rather than `ZipUtil.unpack(...)`.

## Fix

- zt-zip: move to `1.18.0`

## Timeline

- 2026-11-03T18:22:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63436

## Documents

- [advisory] Vendor advisory: github.com https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr
- [fix] Patch: github.com https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd
- [fix] Release notes: github.com https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0

## From the sources

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_