Info-ZIP test option command injection ====================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/infozip-test-option-command-injection.txt

Description -----------

Info-ZIP 3.0 has the '-T' option to test ZIP file integrity. Unfortunately this option contains a command injection (CWE-78) vulnerability. This vulnerability will allow an attacker who controls the archive file name to execute arbitrary commands in the context of the user executing the "zip -T <filename>" command.

Impact ------

The impact of this vulnerability depends on the context where the "zip -T <filename>" command is executed. The most impacted are automated systems that perform the command in response to an external party providing a zip file (such as a website upload form or message attachment or similar).

Proof-of-Concept ----------------

This Proof-of-Concept demonstrates the Info-ZIP command injection vulnerability:

1. echo foo > foo; zip "';id >poc;'.zip" foo

2. zip -T "';id >poc;'.zip"

3. cat poc

Platforms affected ------------------

General UNIX Info-ZIP is affected. Other platforms might also be affected, but were not tested.

zip command in macOS is not affected.

Versions affected -----------------

Version 1.1 and earlier are not affected (functionality not implemented yet). Versions 2.2 to 3.0 (inclusive) are affected. Unreleased beta versions 3.1a, 3.1b, 3.1c are affected.

Recommendations to vendor -------------------------

Do not use the system() function to execute commands. Rather, always use posixspawn() when available, and (v)fork() + execve() as a fallback. Alternatively, quote the command line options in a way that doesn't allow escaping the quoting.

Mitigations -----------

Update to Info-ZIP version that includes a fix (). If updating zip is not possible, replace the use of "zip -T" with "unzip -t" or other means of validating the ZIP archive integrity.

) https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch

Timeline --------

2026-07-31 Discovered the vulnerability and reported it to Info-ZIP via the project bug tracker. 2026-07-31 Identified that Apple appears to have fixed the very issue in 2008 already in https://github.com/apple-oss-distributions/zip/blob/zip-11.1/zip/patch-Apple Unfortunately it appears this fix never migrated to upstream. 2026-07-31 Reported the issue again over email. 2026-07-31 Requested CVE ID from MITRE CNA-LR (CAN-2026-2034879). 2026-08-07 Debian bug #1143866 submitted by Info-ZIP project with a fix. 2026-08-07 zip 3.0-16 with a fix released in Debian sid. 2026-08-14 Debian DSA 6439-1 released. 2026-08-14 This advisory released.

Directory traversal vulnerability in UnZip 5.50 allows attackers to overwrite arbitrary files via invalid characters between two . (dot) characters, which are filtered and result in a ".." sequence.

The NEEDBITS macro in the inflatedynamic function in inflate.c for unzip can be invoked using invalid buffers, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a free of uninitialized or previously-freed data.

A null pointer dereference was found in unzip. The bug appears to be located in the code responsible for handling Unicode strings. This allows an attacker to perform a denial of service and possibly opens up other attack vectors.

References:

https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1957077

Directory traversal vulnerability in Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename.

Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via filenames in the archive that begin with the '/' (slash) character.

Buffer overflow in Info-Zip 2.3 and possibly earlier versions, when using recursive folder compression, allows remote attackers to execute arbitrary code via a ZIP file containing a long pathname.

Buffer overflow in UnZip 5.50 and earlier allows user-assisted attackers to execute arbitrary code via a long filename command line argument. NOTE: since the overflow occurs in a non-setuid program, there are not many scenarios under which it poses a vulnerability, unless unzip is passed long arguments when it is invoked from other programs.

Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.

Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges.

Wiz 5.0.3 has a user mode write access violation

Buffer overflow in the charsettointern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string, as demonstrated by converting a string from CP866 to UTF-8.

A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly achieve code execution.

An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive memory.

An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive memory.

A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly achieve code execution.

oCERT reports an unzip flaw discovered by Michele Spagnuolo, Google Security Team:

""" The write error shows a problem in extract.c:testcompreb(), which was not expecting an uncompressed size of zero for an EFNTSD extra block.

Proposed changes:

http://antinode.info/ftp/info-zip/unzip60/extract.c

extract.c:testcompreb() gets a new validity test. """

Acknowledgement:

Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter.

oCERT reports an unzip flaw discovered by Michele Spagnuolo, Google Security Team:

""" The read errors show problems in process.c:getZip64Data(), which lacked any error detection or reporting, and was trying to extract multi-byte data from a buffer which did not contain enough bytes.

Proposed changes:

http://antinode.info/ftp/info-zip/unzip60/fileio.c fileio.c:dostring() looks at the status value returned from process.c:getZip64Data(), and puts out a new warning. http://antinode.info/ftp/info-zip/unzip60/process.c process.c:getZip64Data() gets new validity tests, and it returns a useful status value. """

Acknowledgement:

Red Hat would like to thank oCERT for reporting these issues. oCERT acknowledges Michele Spagnuolo of the Google Security Team as the original reporter.

Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive has a crafted relationship between the compressed-size value and the uncompressed-size value, because a buffer size is 10 and is supposed to be 12.

References:

https://bugzilla.suse.com/showbug.cgi?id=1110194 https://sourceforge.net/p/infozip/bugs/53/ https://src.fedoraproject.org/rpms/unzip/blob/master/f/unzip-6.0-overflow-long-fsize.patch