CVE-2026-63499Medium· 6.9▾ TwilightPoC availablezt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ re…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.
zt-zip < 1.18.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63436Medium· 6.1zt-zip: Path traversal in fluent API unpack
CVE-2026-62855Medium· 4.4FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Files
CVE-2026-120225Critical· 9.1Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal
CVE-2026-61725Medium· 6.1sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites
CVE-2026-120311High· 8.8Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID
CVE-2026-110746High· 7.8A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUT…