Is there a public PoC exploit available for EUVD-2026-48450?

Yes, a public proof-of-concept exploit is available for EUVD-2026-48450. Prioritise patching immediately. EPSS: 0.5%.

Ne-Lexa php-zip EUVD-2026-48450

Q: What is the CVSS score of EUVD-2026-48450?

EUVD-2026-48450 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-16767 MEDIUM

Path Traversal (CWE-22)

2026-07-23 VulDB

GHSA-rqr8-4xxr-j89f

PHP Path Traversal Php Zip

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable, no privileges or interaction required; impact limited to low integrity and availability write primitive within the application's filesystem scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jul 23, 2026 - 23:22 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

Jul 23, 2026 - 22:48 vuln.today

CVE Published

Jul 23, 2026 - 22:15 cve.org

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Path traversal in Ne-Lexa php-zip up to version 4.0.2 allows remote attackers to write files outside the intended extraction directory by supplying a crafted entryName argument to ZipFile::extractTo(). Any PHP application that processes untrusted ZIP archives using this library is exposed to arbitrary file write at the web server's permission level. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists via a GitHub issue report, and the project maintainer has not yet responded to the disclosure, leaving all affected versions unpatched.

Technical ContextAI

Ne-Lexa php-zip is a PHP library for reading and writing ZIP archives, identified by CPE cpe:2.3:a:ne-lexa:php-zip:*:*:*:*:*:*:*:*. The vulnerability resides in src/ZipFile.php within the ZipFile::extractTo() method, which handles extraction of individual ZIP entries. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), a classic path traversal flaw: the entryName parameter - derived from the ZIP archive's internal entry filenames - is not sanitized to strip directory traversal sequences such as '../' before being used to construct the target filesystem path. This allows a malicious archive to place files at arbitrary locations accessible to the PHP process, rather than confining them to the specified extraction directory.

RemediationAI

No vendor-released patch is available at time of analysis - the project has not responded to the coordinated disclosure. As a primary compensating control, applications should sanitize ZIP entry names before passing them to ZipFile::extractTo(): validate that the resolved extraction path remains within the intended target directory using PHP's realpath() combined with a prefix check, or apply basename() to strip all directory components from entryName. A more robust alternative is to avoid extracting untrusted ZIP archives with this library entirely until a patched release is available, substituting a maintained library with built-in path traversal protection. If extraction is operationally necessary, restrict the PHP process user's write permissions to only the intended extraction directory via filesystem ACLs, limiting the blast radius of a successful traversal. Monitor VulDB advisory https://vuldb.com/vuln/382660 and the GitHub repository https://github.com/Ne-Lexa/php-zip/ for patch availability.