Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80427— bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter

Quick assessment

Affected
nfriedly bestzip
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

BestZip 在构建传递给系统 zip 命令行的参数列表时，未将选项与操作数分隔开。目标归档文件路径以及调用方提供的源文件路径被传递给子进程时，两者之间没有使用 分隔符，因此任何以连字符（ ）开头的源文件名会被 zip 解释为选项，而不是文件名。 zip 支持使用 选项在归档完成后对其完整性进行测试，并使用 指定用于执行该测试的命令。因此，如果源文件列表中包含这两个选项以及一个命令字符串，zip 会在归档写入完成后，通过 shell 执行该命令。 因此，任何将来自不可信来源的文件名或路径传入 BestZip AP

CVSS 8.4 · High

Possible ATT&CK Techniques 1 AI

T1059.004 · Unix Shell

Affected Version Matrix 2

VendorProduct Version RangeStatus
nfriedly bestzip < 2.2.6 affected
3.0.0< 3.0.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80427

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter
Source: CVE Program / CVE List V5
Vulnerability Description
bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name the command used to perform that test, so a source list containing those two entries and a command string causes zip to run that command through a shell once the archive has been written. An application that passes a file name or path it received from an untrusted source into the bestzip API therefore executes a command of the supplier's choosing. Versions 2.2.6 and 3.0.2 add the delimiter.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
nfriedly bestzip 0 ~ 2.2.6 -

II. Public POCs for CVE-2026-80427

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 6476 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-80427

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-80427 (2)

Proof of Concept for CVE-2026-80427 (1)

IV. Related Vulnerabilities

Same product: bestzip
Same weakness: CWE-88

V. Comments for CVE-2026-80427

No comments yet

Leave a comment