Every CVE Search/ Get API key

CVE-2021-21706

ZipArchive::extractTo may extract outside of destination dir

5.3 MediumFix available

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

1.52%Up 1.1 points since Oct 4, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.3

ZipArchive::extractTo may extract outside of destination dir

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
CVE-2021-21706
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness
CWE-24
Updated
2026-11-02
EUVDEUVD-2021-8878 5.3

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
EUVD-2021-8878
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-x4g4-47f7-vvq4 No score

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft...

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
GHSA-x4g4-47f7-vvq4
Weakness
CWE-22
Updated
2026-11-02
NVD 5.3

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
CVE-2021-21706
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-24, CWE-22
Updated
2026-11-02
OSVALPINE-CVE-2021-21706 6.5

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
ALPINE-CVE-2021-21706
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-03
OSVBELL-CVE-2021-21706 6.5

CVE-2021-21706 does not affect BellSoft software

Record
BELL-CVE-2021-21706
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 9 moreShow less
OSV 6.5

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
CVE-2021-21706
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-21706 6.5

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
UBUNTU-CVE-2021-21706
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVBIT-libphp-2021-21706 No score

ZipArchive::extractTo may extract outside of destination dir

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
BIT-libphp-2021-21706
Updated
2026-11-02
OSVBIT-php-2021-21706 No score

ZipArchive::extractTo may extract outside of destination dir

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
BIT-php-2021-21706
Updated
2026-11-02
OSVBIT-php-min-2021-21706 No score

ZipArchive::extractTo may extract outside of destination dir

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Record
BIT-php-min-2021-21706
Updated
2026-11-02
OSVopenSUSE-SU-2024:11167-1 No score

php7-7.4.24-1.1 on GA media

These are all security issues fixed in the php7-7.4.24-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11167-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11169-1 No score

php8-8.0.11-1.1 on GA media

These are all security issues fixed in the php8-8.0.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11169-1
Updated
2026-11-02
OSVSUSE-SU-2022:4068-1 No score

Security update for php74

This update for php74 fixes the following issues:

  • Version update to 7.4.33:

  • CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

  • CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

  • Version update to 7.4.32 (jsc#SLE-23639)

  • CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

  • CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

Record
SUSE-SU-2022:4068-1
Updated
2026-11-02
OSVSUSE-SU-2022:4069-1 No score

Security update for php7

This update for php7 fixes the following issues:

  • Version update to 7.4.33:

  • CVE-2022-31630: Fixed out-of-bounds read due to insufficient input validation in imageloadfont() (bsc#1204979).

  • CVE-2022-37454: Fixed buffer overflow in hash_update() on long parameter (bsc#1204577).

  • Version update to 7.4.32 (jsc#SLE-23639)

  • CVE-2022-31628: Fixed an uncontrolled recursion in the phar uncompressor while decompressing 'quines' gzip files. (bsc#1203867)

  • CVE-2022-31629: Fixed a bug which could lead an attacker to set an insecure cookie that will treated as secure in the victim's browser. (bsc#1203870)

Record
SUSE-SU-2022:4069-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php7
Alpine:v3.12
 before 7.3.31-r0
7.3.31-r0
php7
Alpine:v3.13
 before 7.4.24-r0
7.4.24-r0
php7
Alpine:v3.14
 before 7.4.24-r0
7.4.24-r0
php7
Alpine:v3.15
 before 7.4.24-r0
7.4.24-r0
php8
Alpine:v3.13
 before 8.0.11-r0
8.0.11-r0
php8
Alpine:v3.14
 before 8.0.11-r0
8.0.11-r0
php8
Alpine:v3.15
 before 8.0.11-r0
8.0.11-r0
php8
Alpine:v3.16
 before 8.0.11-r0
8.0.11-r0
php81
Alpine:v3.16
 before 8.1.0_rc3-r0
8.1.0_rc3-r0
php81
Alpine:v3.17
 before 8.1.0_rc3-r0
8.1.0_rc3-r0
Show 23 moreShow less
Affected packages
PackageAffectedFixed
php81
Alpine:v3.18
 before 8.1.0_rc3-r0
8.1.0_rc3-r0
php81
Alpine:v3.19
 before 8.1.0_rc3-r0
8.1.0_rc3-r0
libphp
Bitnami
 7.3.0 up to 7.3.31, 7.4.0 up to 7.4.24, 8.0.0 up to 8.0.11
7.3.317.4.248.0.11
php
Bitnami
 7.3.0 up to 7.3.31, 7.4.0 up to 7.4.24, 8.0.0 up to 8.0.11
7.3.317.4.248.0.11
php-min
Bitnami
 7.3.0 up to 7.3.31, 7.4.0 up to 7.4.24, 8.0.0 up to 8.0.11
7.3.317.4.248.0.11
php74
SUSE:Linux Enterprise Module for Web and Scripting 12
From an advisory covering 18 CVEs
 before 7.4.33-1.47.2
7.4.33-1.47.2
php74
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 18 CVEs
 before 7.4.33-1.47.2
7.4.33-1.47.2
php7
SUSE:Linux Enterprise Module for Package Hub 15 SP3
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Linux Enterprise Module for Web and Scripting 15 SP3
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Linux Enterprise Server 15 SP2-BCL
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Linux Enterprise Server 15 SP2-LTSS
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Linux Enterprise Server for SAP Applications 15 SP2
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Manager Proxy 4.1
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Manager Retail Branch Server 4.1
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Manager Server 4.1
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
SUSE:Enterprise Storage 7
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
openSUSE:Leap 15.3
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7-test
openSUSE:Leap 15.3
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
openSUSE:Leap 15.4
From an advisory covering 18 CVEs
 before 7.4.33-150200.3.46.2
7.4.33-150200.3.46.2
php7
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
 before 7.4.24-1.1
7.4.24-1.1
php8
openSUSE:Tumbleweed
From an advisory covering 97 CVEs
 before 8.0.11-1.1
8.0.11-1.1

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
affected
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-21706 is a medium vulnerability (CVSS 5.3) in Php, published October 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in php7 7.3.31-r0.

References

Show 122 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open