Dashboard / CVE-2026-63499

CVE-2026-63499

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 39/100
Published: 2026-11-03 Modified: 2026-11-12 First seen: 2026-11-03 Status: active

Attack Surface

Low Complexity No Auth Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
S: X
AT: None
VC: None
VI: High
VA: Low

Description

zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
zeroturnaround zt-zip < 1.18.1
zeroturnaround zt-zip < 1.18.1

References & Advisories (4)

Bug Bounty Relevance

39 / 100
✓ No authentication
✓ Low complexity

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.28%
Raw Score 0.002800
Percentile 20.8%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00280
2026-11-13
0.00280
2026-11-12
0.00280
2026-11-10
0.00280
2026-11-09
0.00280
2026-11-08
0.00280
2026-11-07
0.00280
2026-11-06
0.00280
2026-11-05
0.00280
2026-11-04
0.00280

Intelligence Sources

mitre ref →
nvd ref →

External Links