Path Traversal Vulnerability in zt-zip Java Library

CVE-2026-63499

What is CVE-2026-63499?

The zt-zip Java library, used for ZIP archive manipulation, presents a vulnerability that affects how permissions are applied during the extraction of ZIP files. Versions prior to 1.18.1 allow for the exploitation of path traversal because the ZipUtil.unpack(...) method can utilize stored permissions for a directory when provided with self-referencing entry names like '/' or './'. This improper handling can replace secure output-directory permissions with those specified by an attacker when extracting untrusted ZIP files. This vulnerability impacts applications running on POSIX systems directly, while providing limited fallback methods on others through ZTFilePermissionsUtil. The issue has been addressed in version 1.18.1.

References