CVE-2021-21706
CVE-2021-21706 · ZipArchive::extractTo may extract outside of destination dir
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.
CVSS 5.3 · Medium · EPSS 1.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
php
- Versions
- ≥ 7.3.x, < 7.3.31: Affected (custom)
- ≥ 7.4.x, < 7.4.24: Affected (custom)
- ≥ 8.0.X, < 8.0.11: Affected (custom)
Update to 7.3.31; Update to 7.4.24; Update to 8.0.11