Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2021-21706

ZipArchive::extractTo may extract outside of destination dir

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
php

Description

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

PHP Group PHP

  • 7.3.x to < 7.3.31affected
  • 7.4.x to < 7.4.24affected
  • 8.0.X to < 8.0.11affected

References