CVE-2026-80427: bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injection via Missing Option Delimiter
bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name the command used to perform that test, so a source list containing those two entries and a command string causes zip to run that command through a shell once the archive has been written. An application that passes a file name or path it received from an untrusted source into the bestzip API therefore executes a command of the supplier's choosing. Versions 2.2.6 and 3.0.2 add the delimiter.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
bestzipto a version that resolves this vulnerability.Fixed in 2.2.6 - Upgrade
Upgrade
bestzipto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Which applications are exposed to command execution?
Applications are exposed when they pass file names or paths obtained from an untrusted source into the bestzip API. The attacker-controlled source entry must be able to begin with a hyphen so that zip interprets it as an option.
What input is needed to exploit the issue?
An attacker needs control over the source-path list supplied to bestzip. The described exploit uses entries equivalent to -T and -TT together with a command string, causing zip to invoke that command through a shell after writing the archive.
Are archive destination paths also relevant?
Yes. bestzip passes both the destination archive path and caller-supplied source paths to zip without a -- option delimiter, so either position is not explicitly separated from zip options. The described command-execution path specifically relies on attacker-controlled source entries.
What versions address the issue?
bestzip version 2.2.6 addresses the issue on the 2.x line, and version 3.0.2 addresses it on the 3.0.x line. These versions add the -- delimiter between zip options and operands.