A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal.
It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 6
Related Vulnerabilities
CVE-2026-63227
An Unrestricted Scorm File Upload Vulnerability In Koollab Lms Allowed An Authenticated Module Designer To Upload A Scorm Package Containing A Php Webshell To A Publicly Accessible Directory And Execute Arbitrary Code On The Server.
CVE-2026-59943
Dompdf
CVE-2026-59942
Dompdf
CVE-2026-59941
Dompdf
CVE-2026-56722
Dompdf