CVE-2026-63436— zt-zip: Path traversal in fluent API unpack

Quick assessment

Affected

zeroturnaround zt-zip

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

zt-zip 是一个提供 ZIP 归档操作便捷方法的 Java 库。在 1.18.0 版本之前，位于中的流式 API 调用会直接根据 ZIP 条目名称构造输出文件，而未应用所使用的目标路径边界验证机制。因此，一个精心构造的、包含父目录遍历路径的条目，既可通过常规复制分支，也可通过分支，将文件写入到指定的之外。仅通过提取不可信归档的应用程序不受此问题影响，因为该 API 内部已调用进行路径遍历检查。此问题已在 1.18.0 版本中修复。

CVSS 6.1 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1105 · Ingress Tool Transfer T1203 · Exploitation for Client Execution

Affected Version Matrix 1

Vendor	Product	Version Range	Status
zeroturnaround	zt-zip	`< 1.18.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

zt-zip: Path traversal in fluent API unpack

Source: CVE Program / CVE List V5

Vulnerability Description

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
zeroturnaround	zt-zip	< 1.18.0	-

II. Public POCs for CVE-2026-63436

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-63436

请登录查看更多情报信息。

Other References for CVE-2026-63436 (4)

https://github.com/zeroturnaround/zt-zip/pull/180 x_refsource_MISC
https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0 x_refsource_MISC
https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr x_refsource_CONFIRM
https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-63436

IV. Related Vulnerabilities

Same product: zt-zip

Same vendor: zeroturnaround

Same weakness: CWE-22