CVE-2026-16767

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16767

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16767.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16767

Published

2026-07-23T22:15:11.686Z

Modified

2026-07-25T04:14:41.352570242Z

Severity

5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal

Details

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16767.json"
}

References

Affected packages

Git / github.com/ne-lexa/php-zip

Affected ranges

Type

GIT

Repo

https://github.com/ne-lexa/php-zip

Events

Introduced

668afcf81ac4f05fbc428fd137507a13eb49fa9e

Last affected

88a1b6549be813278ff2dd3b6b2ac188827634a7

Database specific

{
    "extracted_events": [
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        },
        {
            "introduced": "4.0.1"
        },
        {
            "last_affected": "4.0.1"
        },
        {
            "introduced": "4.0.2"
        },
        {
            "last_affected": "4.0.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*

4.0.0

4.0.1

4.0.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16767.json"