CVE-2026-63499: zt-zip: ZipUtil.unpack can change file permissions of output directory

Published Nov 3, 2026

Updated

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.

Event History

Nov 3, 2026

CVE Published

via MITRE·06:04 PM

Data Sourced

via MITRE·06:04 PM

DescriptionWeakness

Data Sourced

via OSV·06:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Applications using zt-zip versions earlier than 1.18.1 are affected if they call ZipUtil.unpack(...) on untrusted ZIP archives. POSIX systems demonstrate the permission change directly; other supported systems use fallback handling through ZTFilePermissionsUtil.fetchDefaultStrategy.

What must an attacker provide to exploit it?

An attacker needs to influence a ZIP archive processed by ZipUtil.unpack(...). The archive must contain a self-referencing entry name, such as / or ./, that resolves to the extraction output directory and carries attacker-controlled stored permissions.

Are path traversal protections sufficient to prevent this?

No. The traversal checks prevent entries from escaping the destination, but permit self-referencing entries that resolve to the destination directory itself, allowing the permission-handling path to alter that directory's permissions.

What is the available fix?

Upgrade zt-zip to version 1.18.1, which fixes the issue.

CVE-2026-63499: zt-zip: ZipUtil.unpack can change file permissions of output directory

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to exploit it?

Are path traversal protections sufficient to prevent this?

What is the available fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker provide to exploit it?

Are path traversal protections sufficient to prevent this?

What is the available fix?