Argument Injection Vulnerability in Bestzip by Nfriedly

CVE-2026-80427

What is CVE-2026-80427?

The Bestzip library fails to properly separate options from operands when creating arguments for the system zip utility. This flaw can lead to command injection, where a malicious source file with a name starting with a hyphen may be interpreted as an option by the zip utility. For instance, entries such as -T or -TT could execute unintended commands through a shell, posing a significant security risk when an application accepts file paths or names from untrusted sources. Versions 2.2.6 and 3.0.2 fix this issue by appropriately adding a delimiter between options and source paths.

References