https://seclists.org/oss-sec/2026/q3/494: Info-ZIP test option (-T) command injection
Published Aug 14, 2026
·Updated
Affected Software
1 affected component
Info-ZIP Info-ZIP zip>1.1<=3.0, >=3.1a<=3.1c
Frequently Asked Questions
1
Who is most exposed to this issue?
Automated systems that run "zip -T <filename>" after receiving a ZIP file from an external party are most impacted. Examples given include website upload forms and message attachments.
2
What does an attacker need to control to exploit it?
The attacker needs control of the archive filename used in the "zip -T <filename>" invocation. A crafted filename can cause arbitrary commands to execute as the user running that command.
3
Which platforms are known to be affected?
General UNIX Info-ZIP is affected. Other platforms may also be affected, but were not tested.