CVE-2008-5658

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier...

7.5 HighFix available

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.

Exploit likelihood

4.03%Up 1.3 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2008-5658
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-5658
Updated: 2026-11-02

EUVDEUVD-2008-5629 No score

Record: EUVD-2008-5629
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3jwh-q6hx-pvmh No score

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier...

Record: GHSA-3jwh-q6hx-pvmh
Weakness: CWE-22
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`php5` Debian:4.0	before 5.2.0+dfsg-8+etch15, plus listed versions 5.2.0-105.2.0-10+lenny15.2.0-115.2.0-8+etch15.2.0-8+etch10 Show 12 moreShow less 5.2.0-8+etch115.2.0-8+etch11~p15.2.0-8+etch135.2.0-8+etch35.2.0-8+etch45.2.0-8+etch5~pu15.2.0-8+etch65.2.0-8+etch75.2.0-8+etch85.2.0-8+etch95.2.0-8+etch9~bpo31+15.2.0-9	5.2.0+dfsg-8+etch15
`php5` Debian:5.0	before 5.2.6.dfsg.1-1+lenny3, plus listed versions 5.2.6.dfsg.1-1+lenny2	5.2.6.dfsg.1-1+lenny3
`php5` Debian:5.0	before 5.2.6.dfsg.1-1+lenny2	5.2.6.dfsg.1-1+lenny2
`php` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-bcmath` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-cli` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-common` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-dba` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-debuginfo` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-devel` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2

Show 13 moreShow less

Affected packages
Package	Affected	Fixed
`php-gd` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-imap` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-ldap` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-mbstring` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-mysql` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-ncurses` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-odbc` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-pdo` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-pgsql` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-snmp` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-soap` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-xml` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2
`php-xmlrpc` Red Hat:rhel_application_stack:2	before 0:5.2.6-4.el5s2	0:5.2.6-4.el5s2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-5658 is a high vulnerability (CVSS 7.5) in Php, published December 17, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.03%, the 90th percentile. Fixed in php5 5.2.0+dfsg-8+etch15.

References

Show 51 moreShow less