CVE-2026-16767

Name of the Vulnerable Software and Affected Versions Ne-Lexa php-zip versions prior to 4.0.3

Description A path traversal issue exists in the ZIP Handler component within the ZipFile::extractTo() function located in the src/ZipFile.php file. A remote attacker can exploit this by manipulating the entryName argument, allowing files to be written outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict the use of the ZipFile::extractTo() function to minimize the risk of exploitation.