Description

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of archive entry paths before writing files to disk which could result in full system compromise.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-20T09:16:46.977Z",
  "pubdate": "2026-08-20T09:16:46.977Z",
  "executiveSummary": "This vulnerability involves an improper validation flaw concerning archive entry paths during the extraction of ZIP files, leading to a path traversal vulnerability. A high-privileged remote attacker can leverage this security deficiency to escape the intended extraction directory boundaries, thereby enabling arbitrary file write capabilities across the underlying server filesystem.\nThe primary impact of this flaw is the potential for full system compromise, as an attacker can overwrite critical system configurations, place executable scripts into web-accessible directories, or manipulate system binaries to achieve arbitrary code execution.\nThe risk implication is critical due to the elevated privileges required for exploitation combined with the catastrophic nature of a full system compromise. Exploitation requires the attacker to possess high privileges and the ability to upload a specifically crafted malicious ZIP archive containing directory traversal sequences such as ../ to target arbitrary file locations during the server-side extraction process.",
  "technicalDetails": "The root cause of the vulnerability resides in the insufficient sanitization and validation of archive entry filenames within the file extraction mechanism. Specifically, the parsing logic fails to adequately check or strip relative path traversal sequences, such as dot-dot-slash (../), present in the headers of individual compressed files contained within the ZIP archive.\nThe vulnerable component is the archive processing and extraction routine responsible for handling uploaded ZIP files and writing their contents to disk. The network exposure is remote, and the attack requires high privileges to successfully upload and process the malicious archive through the application interface.\nThe attack flow proceeds in a sequential manner. First, the high-privileged attacker crafts a malicious ZIP archive where one or more internal file entries incorporate directory traversal sequences (../) within their metadata paths. Second, the attacker uploads this specially crafted archive to the server through the designated upload functionality. Third, the application receives the archive and initiates the extraction process without performing canonicalization or boundary checks on the destination paths derived from the archive entries.\nAs the extraction engine processes each file entry, the payload behavior manifests as the traversal sequences force the filesystem write operations to ascend out of the designated secure extraction directory and target arbitrary absolute or relative paths on the server. Consequently, files can be written to sensitive system locations.\nThe post-exploitation impact includes the ability to achieve arbitrary code execution by overwriting existing application source code, configuration files, or binaries with malicious payloads. Given the file write capabilities spanning arbitrary locations on the server, this flaw ultimately culminates in a full system compromise."
}