CVE-2026-63436

Name of the Vulnerable Software and Affected Versions zt-zip versions prior to 1.18.0

Description The fluent API Zips.get(zip).unpack().destination(outputDir).process() in the Zips.java file constructs output files directly from ZIP entry names. It fails to apply destination-boundary validation, which allows a crafted entry containing parent-directory traversal to write files outside the specified outputDir via the normal copy branch or the ZipEntryTransformer branch. Parent-directory traversal is a technique used to access and modify files outside the intended directory by using special characters like ../ in file paths.

Recommendations Update to version 1.18.0. As a temporary mitigation, avoid using the Zips.get(zip).unpack().destination(outputDir).process() API when extracting untrusted archives.