zt-zip CVE-2026-63436

The application must extract an untrusted/attacker-supplied ZIP archive specifically through the Zips fluent API - Zips.get(zip).unpack().destination(dir).process() - on a vulnerable version (<= 1.17); both the normal copy branch and the ZipEntryTransformer branch are affected. The malicious archive must contain an entry whose name uses parent-directory traversal (e.g. '../escape/poc.txt' or a trailing-slash directory entry like '../escape/'). LIMITING FACTORS: applications that extract untrusted archives only via ZipUtil.unpack(...) are entirely unaffected because that API already calls checkDestinationFileForTraversal; exploitation requires the victim application to process the attacker's archive (UI:R) and depends on filesystem permissions and application layout for the write to be impactful; the vector is local (AV:L), so there is no direct remote network trigger in the CVSS assessment. Successful traversal writes are also bounded by where the destination directory sits and what paths the process can write to.

This is a genuine but conditional path-traversal write (CWE-22) rated 6.1 Medium, and the signals are internally consistent rather than inflated. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L describes a local vector requiring victim interaction (the application must be made to process an attacker-supplied archive), no privileges, low complexity, arbitrary file write (I:H) with no confidentiality loss (C:N) and limited availability impact (A:L) - which fits an arbitrary-file-write-outside-destination primitive, not remote code execution. The vuln.today priority is 'this_month' (not act_now/emergency), it is NOT on CISA KEV, and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. A detailed public proof-of-concept with observed output is present in the GHSA advisory, demonstrating the flaw is real and trivially reproducible, but PoC availability is distinct from active exploitation. Crucially, exploitation is gated on the application's choice of API: only the Zips fluent unpack path is affected, while ZipUtil.unpack(...) was never vulnerable. Net: a real, actionable issue to patch this cycle, but its blast radius is scoped to a specific API usage and local/interaction-dependent delivery, so it is not a drop-everything network-exploitable emergency. EPSS is missing, which limits probabilistic prioritization.

An application uses Zips.get(zip).unpack().destination(outputDir).process() to extract archives that originate from untrusted users (e.g. an upload or import feature). An attacker submits a crafted ZIP containing an entry named like '../escape/poc.txt'; when the app extracts it, the file is written outside outputDir, enabling arbitrary file write that could overwrite configuration, scripts, or other sensitive files subject to filesystem permissions. A working proof-of-concept with observed output is published in the GHSA advisory, and because AV:L/AC:L the main barrier is simply getting the victim application to process the malicious archive (UI:R).