CVE-2026-80427

Name of the Vulnerable Software and Affected Versions bestzip versions prior to 2.2.6 bestzip versions prior to 3.0.2

Description The software constructs the argument list for the system zip utility without separating options from operands. Because the destination archive path and caller-supplied source paths are passed to the child process without a -- delimiter, any source entry starting with a hyphen is interpreted as an option. Specifically, the zip utility accepts -T to test the archive and -TT to specify the command for that test. If a source list contains these entries and a command string, the utility executes that command through a shell. Consequently, an application passing untrusted file names or paths into the bestzip API allows for arbitrary command execution.

Recommendations Update to version 2.2.6 or later. Update to version 3.0.2 or later.