kiwilan php-archive CVE-2026-112302

Exploitation requires that a PHP application embed kiwilan/php-archive (<= 2.3.02) and call ArchiveZip::extract on an attacker-controlled or attacker-supplied ZIP archive; the attacker cannot trigger it unaided. The limiting factor encoded as UI:P/UI:R is this required processing action - a user or application must choose to extract the malicious archive, so there is no direct remote-unauthenticated server exploitation against a default service. Impact is further bounded to writing files outside the intended target directory (classic Zip Slip), and realistic damage depends on the extraction path, filesystem permissions, and whether overwritten locations are security-sensitive.

This is a LOW real-world priority despite being a publicly-disclosed path traversal (Zip Slip) issue. The CVSS 4.0 base score is only 2.1, with the vendor-supplied vector AV:N/AC:L/AT:N/PR:N/UI:P and limited low-rated impacts (VC:L/VI:L/VA:L), meaning no single impact dimension is high. The strongest escalating signal is POC availability - a public exploit gist exists and E:P (Proof-of-Concept) is encoded in the vector - but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The UI:P component is decisive: exploitation is not fully automatable because a victim application/user must actually extract an attacker-supplied archive using the vulnerable ArchiveZip::extract function. The report originates solely from VulDB and the vendor was contacted but did not respond, so there is no vendor advisory or confirmed patch - treat affected-version and fix data as unverified. Net: a real but low-severity library bug with public POC, not a drop-everything issue.

An attacker crafts a ZIP archive containing entries with '../' path-traversal sequences in their filenames and gets a PHP application that uses kiwilan/php-archive to process it (e.g. an upload or import feature). When the application calls ArchiveZip::extract, files are written outside the intended extraction directory, potentially overwriting or planting files elsewhere on disk. A public proof-of-concept exploit is available on GitHub (gist by 0xSebin).