Executive brief
Zhoros SuperBin is a file-sharing application used to upload and download files. A vulnerability in the way it packages multiple files into a ZIP archive allows an attacker to include malicious filenames. If a user downloads and extracts such an archive on a Windows system, files could be placed in unintended folders outside of the extraction directory, potentially leading to system compromise or data overwriting.
Technical details
A directory traversal vulnerability exists in Zhoros SuperBin v1.0.0 within the multi-file archive generation logic in 'fileWriters.go'. The application uses 'zipWriter.Create' with unsanitized filenames provided in multipart form headers. While forward slashes may be stripped by the server environment, backslashes are preserved in the ZIP entry names. An attacker can upload files with names like '..\\..\\filename.txt', causing the server to generate a ZIP archive containing these traversal sequences. When a victim extracts this archive using a Windows-style extractor that interprets backslashes as path separators, files can be written to arbitrary locations on the victim's filesystem. This is a client-side impact resulting from server-side generation of a malicious archive.
Affected products
- Zhoros SuperBin 1.0.0
Timeline
- 2026-06-13: disclosed: Initial disclosure via GitHub Gist by pyuysig
- 2026-06-15: advisory: CVE-2026-50877 published by NVD