{"id":"CVE-2025-66945","aliases":["EUVD-2025-208245","GHSA-266w-wvvg-f3wv"],"status":"published","title":"A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted...","description":"A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00604,"percentile":0.49333,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2026-03-03T00:00:00Z","modified":"2026-06-17T09:57:20Z","products":[{"vendor":"zdir","product":"zdir"}],"references":[{"url":"https://github.com/kaliworld/Zdir-Pro-Zip-slip-vulnerability/","tags":["Exploit","Mitigation","Third Party Advisory"]},{"url":"https://zeroday.endlessparadox.com/posts/cve-2025-66945/","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66945"},{"url":"https://github.com/kaliworld/Zdir-Pro-Zip-slip-vulnerability"},{"url":"https://zeroday.endlessparadox.com/posts/cve-2025-66945"},{"url":"https://github.com/advisories/GHSA-266w-wvvg-f3wv"}],"sources":{"cve":[{"id":"CVE-2025-66945","description":"A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution","status":"published","published":"2026-03-03T00:00:00Z","modified":"2026-03-04T14:36:39.595Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:32:53.475217Z"}],"euvd":[{"id":"EUVD-2025-208245","description":"A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution","status":"published","published":"2026-03-03T00:00:00Z","modified":"2026-03-04T14:36:39Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:48:11.18109Z"}],"ghsa":[{"id":"GHSA-266w-wvvg-f3wv","title":"A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted...","description":"A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution","status":"published","published":"2026-03-03T21:31:16Z","modified":"2026-03-04T15:31:42Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:06:26.948991Z"}],"nvd":[{"id":"CVE-2025-66945","description":"A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution","status":"published","published":"2026-03-03T20:16:44.187Z","modified":"2026-06-17T09:57:20.67Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:01.096037Z"}]}}