CVE-2026-16767

Publié : 23 juillet 2026

Modifié : 23 juillet 2026

Score CVSS

6.5

MEDIUM

Description détaillée

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Références et Patchs

https://github.com/Ne-Lexa/php-zip/https://github.com/Ne-Lexa/php-zip/issues/100 https://vuldb.com/cve/CVE-2026-16767 https://vuldb.com/submit/862203 https://vuldb.com/vuln/382660 https://vuldb.com/vuln/382660/cti

Dernières Vulnérabilités

CVE-2026-62825

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

VOIR DÉTAILS

CVE-2026-58275

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.

VOIR DÉTAILS

CVE-2026-56191

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.

VOIR DÉTAILS