CVE-2026-63436

    Dashboard / Vulnerabilities / CVE-2026-63436

    CVE-2026-63436

    Published: 3 Nov 2026Last Modified: 5 Nov 2026

    Summary: zt-zip: Path traversal in fluent API unpack

    Details: zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.

    References: https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63436.json, https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr, https://nvd.nist.gov/vuln/detail/CVE-2026-63436, https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd, https://github.com/zeroturnaround/zt-zip/pull/180

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -50abbc455c73f375ff278f963eab9f9044249e1c

    Affected versions

    zt-zip-1.17

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-63436 | CVE-DB