Php Archive
Monthly
A path traversal (Zip Slip) flaw in kiwilan/php-archive through version 2.3.02 lets an attacker craft a ZIP archive whose entry names escape the intended extraction directory when ArchiveZip::extract() is called, allowing files to be written to arbitrary locations the PHP process can reach. The library is a dependency, not a network service, so exploitation requires the host application to pass an attacker-influenced archive to extract() and to run with filesystem permissions that make the overwritten paths meaningful. Publicly available exploit code exists (a proof-of-concept gist is referenced alongside the VulDB entry), but there is no evidence of active exploitation in the wild, and the vendor did not respond to the disclosure.
A path traversal (Zip Slip) flaw in kiwilan/php-archive through version 2.3.02 lets an attacker craft a ZIP archive whose entry names escape the intended extraction directory when ArchiveZip::extract() is called, allowing files to be written to arbitrary locations the PHP process can reach. The library is a dependency, not a network service, so exploitation requires the host application to pass an attacker-influenced archive to extract() and to run with filesystem permissions that make the overwritten paths meaningful. Publicly available exploit code exists (a proof-of-concept gist is referenced alongside the VulDB entry), but there is no evidence of active exploitation in the wild, and the vendor did not respond to the disclosure.