Skip to content
CVE PROGRAM SOURCE RECORD4.6 Medium

CVE-2026-41530

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
jpcert

Description

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name, then the archived files may be extracted to an unexpected folder.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Chitora soft Lhaz

  • 2.6.3 and earlieraffected

Chitora soft Lhaz+

  • 3.6.3 and earlieraffected

References