Php Zip
Monthly
Path traversal in Ne-Lexa php-zip up to version 4.0.2 allows remote attackers to write files outside the intended extraction directory by supplying a crafted entryName argument to ZipFile::extractTo(). Any PHP application that processes untrusted ZIP archives using this library is exposed to arbitrary file write at the web server's permission level. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists via a GitHub issue report, and the project maintainer has not yet responded to the disclosure, leaving all affected versions unpatched.
Path traversal in Ne-Lexa php-zip up to version 4.0.2 allows remote attackers to write files outside the intended extraction directory by supplying a crafted entryName argument to ZipFile::extractTo(). Any PHP application that processes untrusted ZIP archives using this library is exposed to arbitrary file write at the web server's permission level. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists via a GitHub issue report, and the project maintainer has not yet responded to the disclosure, leaving all affected versions unpatched.