Info-ZIP test option command injection ====================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/infozip-test-option-command-injection.txt
Description -----------
Info-ZIP 3.0 has the '-T' option to test ZIP file integrity. Unfortunately this option contains a command injection (CWE-78) vulnerability. This vulnerability will allow an attacker who controls the archive file name to execute arbitrary commands in the context of the user executing the "zip -T <filename>" command.
Impact ------
The impact of this vulnerability depends on the context where the "zip -T <filename>" command is executed. The most impacted are automated systems that perform the command in response to an external party providing a zip file (such as a website upload form or message attachment or similar).
Proof-of-Concept ----------------
This Proof-of-Concept demonstrates the Info-ZIP command injection vulnerability:
1. echo foo > foo; zip "';id >poc;'.zip" foo
2. zip -T "';id >poc;'.zip"
3. cat poc
Platforms affected ------------------
General UNIX Info-ZIP is affected. Other platforms might also be affected, but were not tested.
zip command in macOS is not affected.
Versions affected -----------------
Version 1.1 and earlier are not affected (functionality not implemented yet). Versions 2.2 to 3.0 (inclusive) are affected. Unreleased beta versions 3.1a, 3.1b, 3.1c are affected.
Recommendations to vendor -------------------------
Do not use the system() function to execute commands. Rather, always use posixspawn() when available, and (v)fork() + execve() as a fallback. Alternatively, quote the command line options in a way that doesn't allow escaping the quoting.
Mitigations -----------
Update to Info-ZIP version that includes a fix (). If updating zip is not possible, replace the use of "zip -T" with "unzip -t" or other means of validating the ZIP archive integrity.
) https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch
Timeline --------
2026-07-31 Discovered the vulnerability and reported it to Info-ZIP via the project bug tracker. 2026-07-31 Identified that Apple appears to have fixed the very issue in 2008 already in https://github.com/apple-oss-distributions/zip/blob/zip-11.1/zip/patch-Apple Unfortunately it appears this fix never migrated to upstream. 2026-07-31 Reported the issue again over email. 2026-07-31 Requested CVE ID from MITRE CNA-LR (CAN-2026-2034879). 2026-08-07 Debian bug #1143866 submitted by Info-ZIP project with a fix. 2026-08-07 zip 3.0-16 with a fix released in Debian sid. 2026-08-14 Debian DSA 6439-1 released. 2026-08-14 This advisory released.