- Severity: HIGH
- CVE: CVE-2026-63436
- Ecosystems: maven
- Packages: org.zeroturnaround:zt-zip
### Summary
`ZipUtil.unpack(…)` rejects ZIP entries that escape the target output directory, but the `Zips` fluent API appears to use a separate unpack implementation that does not apply the same destination-boundary check.
A ZIP entry such as:
“`text
../escape/poc.txt
“`
is written outside the configured destination directory when processed with:
“`java
Zips.get(zip).unpack().destination(outputDir).process();
“`
The transformer branch is affected as well.
### Tested Version
commit: 067935dca375500d3ff025aafcdf0e4283931b1a
### Root Cause
In `src/main/java/org/zeroturnaround/zip/Zips.java`, `Zips.UnpackingCallback.process(…)` builds the output file directly from the ZIP entry name:
“`java
String entryName = zipEntry.getName();
File file = new File(destination, entryName);
“`
The method then creates directories/files and copies content to that path:
“`java
FileUtils.forceMkdir(file.getParentFile());
file.createNewFile();
FileUtils.copy(in, file);
“`
When a transformer is configured, the same `file` is passed to `transformIntoFile(…)`.
There does not appear to be a canonical path check before these filesystem writes, so `../` entries can resolve outside `destination`.
### Minimal Reproduction
“`java
import java.io.*;
import java.nio.charset.StandardCharsets;
import java.nio.file.*;
import java.util.zip.*;
import org.zeroturnaround.zip.ZipUtil;
import org.zeroturnaround.zip.Zips;
import org.zeroturnaround.zip.transform.ZipEntryTransformer;
public…
Source: GitHub Security Advisories · 2026-11-09