CVE-2026-63436

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.

• CWE-22

• https://github.com/zeroturnaround/zt-zip/commit/59a76ad576b0fcd50ea018e3608afb946c1492fd
• https://github.com/zeroturnaround/zt-zip/pull/180
• https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.0
• https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-52c6-99qm-3hqr

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63430ammonia is a Rust library for repairing and securing untrust…6.3
• CVE-2026-63431Horilla is an HR and CRM software. In 1.5.0-85 and earlier, …6.5
• CVE-2026-63432Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 an…6.5
• CVE-2026-63433MyTube is a self-hosted downloader and player for several vi…6.8
• CVE-2026-63434MyTube is a self-hosted downloader and player for several vi…4.3
• CVE-2026-63435Mail is an internet library for Ruby designed to handle emai…5.3
• CVE-2026-6344The Fluent Forms plugin for WordPress is vulnerable to Arbit…4.9
• CVE-2026-63442OPNsense is a FreeBSD based firewall and routing platform. P…8.1
• CVE-2026-63443Coder allows organizations to provision remote development e…8.3
• CVE-2026-63445Perses is an open-source dashboard and visualization project…7.1
• CVE-2026-63446Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63447Suricata is a network Intrusion Detection System, Intrusion …7.5