CVE-2021-21706: ZipArchive::extractTo may extract outside of destination dir
In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.
Other sources
Fixed bug (ZipArchive::extractTo extracts outside of destination) (CVE-2021-21706).
— PHP
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this bug?
The vulnerability ID of this bug is CVE-2021-21706.
What is the title of this bug?
The title of this bug is Fixed bug (ZipArchive::extractTo extracts outside of destination) (CVE-2021-21706).
What is the severity of CVE-2021-21706?
The severity of CVE-2021-21706 is medium.
Which versions of PHP are affected by CVE-2021-21706?
PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24, and 8.0.x below 8.0.11 are affected by CVE-2021-21706.
How can CVE-2021-21706 be exploited?
In a Microsoft Windows environment, an attacker can trick ZipArchive::extractTo into writing a file outside the target directory when extracting a ZIP file.