Poqpwppy

**Name of the Vulnerable Software and Affected Versions** bestzip versions prior to 2.2.6 bestzip versions prior to 3.0.2 **Description** The software constructs the argument list for the system zip utility without separating options from operands. Because the destination archive path and caller-supplied source paths are passed to the child process without a `--` delimiter, any source entry starting with a hyphen is interpreted as an option. Specifically, the zip utility accepts `-T` to test the archive and `-TT` to specify the command for that test. If a source list contains these entries and a command string, the utility executes that command through a shell. Consequently, an application passing untrusted file names or paths into the bestzip API allows for arbitrary command execution. **Recommendations** Update to version 2.2.6 or later. Update to version 3.0.2 or later.