CVE-2025-66945

CRITICAL
2026-03-03 [email protected]
9.1
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 22:05 vuln.today
PoC Detected
Mar 04, 2026 - 17:50 vuln.today
Public exploit code
CVE Published
Mar 03, 2026 - 20:16 nvd
CRITICAL 9.1

Tags

RCE Path Traversal Zdir

Description

A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution

Analysis

Zip slip to arbitrary file write in Zdir Pro 4.x ZIP extraction API. PoC available.

Technical Context

CWE-787 path traversal in ZIP extraction.

Affected Products

['Zdir Pro 4.x']

Remediation

Apply patch.

Priority Score

66
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +46
POC: +20

Share

CVE-2025-66945 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy