GHSA-52c6-99qm-3hqr: zt-zip: Path traversal in fluent API unpack
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zt-zipto a version that resolves this vulnerability.Fixed in 1.18.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using zt-zip versions before 1.18.0 are exposed if they extract untrusted ZIP archives through the Zips.get(zip).unpack().destination(outputDir).process() fluent API. Applications that extract archives only through ZipUtil.unpack(...) are unaffected.
What must an attacker provide to exploit the vulnerability?
An attacker must cause the application to process a crafted ZIP archive containing an entry name with parent-directory traversal. User interaction is required according to the supplied severity vector.
Can the vulnerable API write files outside the configured extraction directory?
Yes. The fluent API constructs output paths from ZIP entry names without destination-boundary validation, allowing traversal entries to write outside outputDir in both the normal copy and ZipEntryTransformer branches.
What should be done if an immediate upgrade is not possible?
Do not use the affected fluent unpack API to extract untrusted archives. Use ZipUtil.unpack(...) instead, as it applies checkDestinationFileForTraversal validation.