CVE-2026-112302: kiwilan php-archive Extraction ArchiveZip.php extract path traversal
A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using composer/kiwilan/php-archive version 2.3.02 or earlier are affected when they use the ArchiveZip::extract function in src/Readers/ArchiveZip.php.
What does an attacker need to exploit this issue?
The attack can be performed remotely and requires user interaction. No attacker privileges are required, and public exploit information is available.
What is the likely impact of successful exploitation?
A successful path traversal can affect confidentiality, integrity, and availability at low impact according to the supplied CVSS vector.
Is a vendor fix available?
The provided information does not identify a fixed version. It states that the vendor was contacted before disclosure but did not respond.