CyberRota Analysis
AI-GeneratedA path traversal vulnerability exists in the ZipFile::extractTo function of Ne-Lexa php-zip versions up to 4.0.2, allowing remote attackers to manipulate the entryName argument and potentially access unauthorized files on the server. Organizations using this component should prioritize patching or mitigating this vulnerability, as the exploit is publicly available and could lead to significant data exposure. Immediate action is recommended for those managing applications that rely on this ZIP Handler.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.