---
id: CVE-2026-63436
title: 'zt-zip: Path traversal in fluent API unpack'
summary: >-
  zt-zip is a Java library that provides convenience methods for ZIP archive
  manipulation. Prior to 1.18.0, the
  Zips.get(zip).unpack().destination(outputDir).process() fluent API in
  src/main/java/org/zeroturnaround/zip/Zips.java constructs…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-22
vendor: zeroturnaround
product: zt-zip
affected:
  - zt-zip < 1.18.0
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T18:02:27.180Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63436'
references:
  - url: >-
      https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr
    label: >-
      https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr
  - url: 'https://github.com/zeroturnaround/zt-zip/pull/180'
    label: 'https://github.com/zeroturnaround/zt-zip/pull/180'
  - url: >-
      https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd
    label: >-
      https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd
  - url: 'https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0'
    label: 'https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0'
tags:
  - cve.org
epss: 0.00242
epssPercentile: 0.1538
ingestedAt: '2026-11-05T20:33:06.336Z'
---

## Overview

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.

## Affected

- `zt-zip < 1.18.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.