Directory Traversal Vulnerability in zt-zip Java Library

CVE-2026-63436

What is CVE-2026-63436?

The zt-zip Java library features a fluent API that allows for ZIP archive manipulation. However, versions prior to 1.18.0 are susceptible to a directory traversal vulnerability. This issue arises when output files are constructed directly from ZIP entry names without appropriate destination-boundary validation. An attacker can craft a ZIP entry that uses parent-directory traversal sequences, enabling the extraction of files outside the intended output directory. This flaw can occur in both the normal copy process and the ZipEntryTransformer branch. Notably, applications relying on the ZipUtil.unpack() method, which includes built-in checks against such traversal attacks, remain unaffected. Users are strongly advised to update to version 1.18.0 to mitigate this risk.

References