Every CVESearch/Get API key

CVE-2008-5658

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier...

7.5 High

CVE-2008-5658 is a high vulnerability (CVSS 7.5) in Php, published December 17, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.03%, the 90th percentile. No source names a fixed version.

What does this mean?
Severity
7.5 HighCVSS 2.0, NVD
Exploit chance
4.03%EPSS, 90th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.

Exploit likelihood

4.03%Up 1.3 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php5
Debian:4.0
From an advisory covering 8 CVEs
before 5.2.0+dfsg-8+etch15, plus listed versions
5.2.0-105.2.0-10+lenny15.2.0-115.2.0-8+etch15.2.0-8+etch10
Show 12 moreShow less
5.2.0-8+etch115.2.0-8+etch11~p15.2.0-8+etch135.2.0-8+etch35.2.0-8+etch45.2.0-8+etch5~pu15.2.0-8+etch65.2.0-8+etch75.2.0-8+etch85.2.0-8+etch95.2.0-8+etch9~bpo31+15.2.0-9
5.2.0+dfsg-8+etch15
php5
Debian:5.0
From an advisory covering 8 CVEs
before 5.2.6.dfsg.1-1+lenny3, plus listed versions
5.2.6.dfsg.1-1+lenny2
5.2.6.dfsg.1-1+lenny3
php5
Debian:5.0
From an advisory covering 5 CVEs
before 5.2.6.dfsg.1-1+lenny2
5.2.6.dfsg.1-1+lenny2
php
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-bcmath
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-cli
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-common
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-dba
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-debuginfo
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-devel
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
Show 13 moreShow less
Affected packages
PackageAffectedFixed
php-gd
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-imap
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-ldap
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-mbstring
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-mysql
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-ncurses
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-odbc
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-pdo
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-pgsql
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-snmp
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-soap
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-xml
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2
php-xmlrpc
Red Hat:rhel_application_stack:2
From an advisory covering 8 CVEs
before 0:5.2.6-4.el5s2
0:5.2.6-4.el5s2

What each source reports

NVD Score used7.5

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.

Record
CVE-2008-5658
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-22
Updated
2026-11-02
CVE ListNo score

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.

Record
CVE-2008-5658
Updated
2026-11-02
EUVDEUVD-2008-5629No score

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.

Record
EUVD-2008-5629
Updated
2026-11-03
GitHub AdvisoriesGHSA-3jwh-q6hx-pvmhNo score

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier...

Directory traversal vulnerability in the ZipArchive::extractTo function in PHP 5.2.6 and earlier allows context-dependent attackers to write arbitrary files via a ZIP file with a file whose name contains .. (dot dot) sequences.

Record
GHSA-3jwh-q6hx-pvmh
Weakness
CWE-22
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 51 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open