GHSA-v2g6-7r9j-v6px: zt-zip: ZipUtil.unpack can change file permissions of output directory
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
zt-zipto a version that resolves this vulnerability.Fixed in 1.18.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using zt-zip versions before 1.18.1 are affected if they call ZipUtil.unpack(...) on ZIP archives supplied by untrusted sources. The impact is directly demonstrated on POSIX systems; other supported systems use fallback permission handling through ZTFilePermissionsUtil.fetchDefaultStrategy.
What does an attacker need to include in a ZIP archive?
The attacker needs to supply a ZIP entry whose name resolves to the extraction output directory itself, such as / or ./. The entry can carry attacker-chosen stored permissions, which ZipUtil.unpack(...) may apply to that output directory.
Are extraction paths that remain inside the destination still relevant?
Yes. The vulnerable path-traversal checks permit self-referencing entry names because they do not escape the destination directory. Those entries can nevertheless trigger replacement of restrictive permissions on the destination directory.
What is the available remediation?
Upgrade zt-zip to version 1.18.1, which fixes the issue. Until upgrading is possible, avoid passing untrusted ZIP archives to ZipUtil.unpack(...).