Soumettre #862203: Ne-Lexa php-zip 4.0.2 and prior Path Traversal: '../filedir'

nelexa/zip ZipFile::extractTo() ZIP Slip via Windows Backslash Traversal

A path traversal vulnerability exists in Ne-Lexa php-zip (Composer package nelexa/zip: https://packagist.org/packages/nelexa/zip) in ZipFile::extractTo(). The method attempts to prevent Zip Slip by normalizing archive entry names, but FilesUtil::normalizeZipPath() only splits paths on the forward slash character "/". On Windows, the backslash character "\" is also treated as a path separator. As a result, a malicious ZIP archive entry such as "..\..\phpzip-poc-marker.txt" is not sanitized and can be written outside the intended extraction directory.

The vulnerable code path is in ZipFile::extractTo(), which calls FilesUtil::normalizeZipPath($entryName) and then writes to $destDir . DIRECTORY_SEPARATOR . $entryName. Since normalizeZipPath() only removes "." and ".." components separated by "/", Windows backslash traversal components remain intact.

Proof of concept:
1. Create a ZIP archive containing an entry named "..\..\phpzip-poc-marker.txt".
2. Extract it on Windows using ZipFile::extractTo() into a nested directory such as "poc-output\extract-root\a\b".
3. The marker file is written to "poc-output\extract-root\phpzip-poc-marker.txt", outside the specified extraction root.

Expected vulnerable output:
Extraction root: C:\path\to\php-zip\poc-output\extract-root\a\b
Escaped marker: C:\path\to\php-zip\poc-output\extract-root\phpzip-poc-marker.txt
Marker exists: yes
Marker content: phpzip windows traversal poc

Impact:
An attacker who can supply a crafted ZIP archive to an application using nelexa/zip on Windows can write or overwrite files outside the intended extraction directory. Depending on the application context and filesystem permissions, this may lead to arbitrary file creation, file overwrite, configuration tampering, denial of service, or placement of attacker-controlled scripts in sensitive locations.

Affected versions:
The latest Packagist release is 4.0.2, and the vulnerable normalization logic is present in current master. Versions up to and including 4.0.2 should be considered affected.

Full technical writeup, reproducible PoC, and discussion: https://github.com/Ne-Lexa/php-zip/issues/100

• La source: ⚠️ https://github.com/Ne-Lexa/php-zip/issues/100
• Utilisateur: zyhhoward (UID 97563)
• Soumission: 17/06/2026 21:02 (il y a 1 mois)
• Modérer: 23/07/2026 16:25 (1 month later)
• Statut: Accepté
• Entrée VulDB: 382660 [Ne-Lexa php-zip jusqu’à 4.0.2 ZIP src/ZipFile.php ZipFile::extractTo entryName directory traversal]
• Points: 20