CVE-2026-63499

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.

• CWE-23

• https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad
• https://github.com/zeroturnaround/zt-zip/pull/191
• https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1
• https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px
• https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px

Published

Nov 3, 2026

Last Modified

Nov 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63490Handlebars.java provides logic-less and semantic Mustache te…7.5
• CVE-2026-63492Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-63493Snipe-IT is an IT asset/license management system. Prior to …8.1
• CVE-2026-63494Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2026-63495Libevent is an event notification library. From 2.2.0-alpha-…7.5
• CVE-2026-63498Snipe-IT is an IT asset/license management system. Prior to …5.4
• CVE-2026-6350MailGates/MailAudit developed by Openfind has a Stack-based …9.8
• CVE-2026-63500Yeti bridges the gap between CTI and DFIR practitioners by p…7.1
• CVE-2026-63501ag-psd is a JavaScript library for reading and writing Photo…7.5
• CVE-2026-63502Yeti bridges the gap between CTI and DFIR practitioners by p…8.3
• CVE-2026-63506Tina is a headless content management system. Prior to @tina…8.8
• CVE-2026-63508Missing authentication for critical function in Microsoft Pl…10