Executive brief
Ne-Lexa php-zip is a PHP library used for managing and extracting ZIP archives. A security flaw in the library's extraction process allows a specially crafted ZIP file to write files to unintended locations on a Windows server. This could allow an attacker to overwrite sensitive configuration files or place malicious scripts in web-accessible directories, potentially leading to a full system compromise.
Technical details
A path traversal vulnerability (Zip Slip) exists in the ZipFile::extractTo function within src/ZipFile.php of the Ne-Lexa php-zip library. The root cause is insufficient sanitization in FilesUtil::normalizeZipPath, which only accounts for forward slashes ('/') when normalizing path components. On Windows environments, backslashes ('\') are also valid path separators; an attacker can bypass the normalization logic by using backslash-separated traversal sequences (e.g., '..\..\shell.php'). When these entries are extracted, they are concatenated with the destination directory, allowing files to be written outside the intended extraction root. This affects all versions up to 4.0.2, and as of the advisory date, no official patch has been released.
Affected products
- Ne-Lexa php-zip (PhpZip) up to 4.0.2
Timeline
- 2026-06-17: disclosed: Issue reported to the developer via GitHub issue #100
- 2026-07-23: advisory: CVE-2026-16767 published