CVE-2026-115908

Name of the Vulnerable Software and Affected Versions zip versions 7.2.0 through 8.x

Description The ZipArchive::extract and ZipArchive::extract unwrapped root dir functions use safe prepare path and simplified components to validate symbolic link targets using lexical prefix comparison instead of resolving each intermediate link. An attacker who knows the absolute extraction destination can create a symlink chain where an intermediate link resolves outside the destination, enabling the creation or overwriting of files with the privileges of the extracting process. On Windows, discarded drive and UNC (Universal Naming Convention) prefixes may allow a single-link escape if the process possesses SeCreateSymbolicLinkPrivilege, which is common for administrator accounts or systems in Developer Mode.

Recommendations Update to version 9.0.0.