Vulnerability · Published Jul 23, 2026 · Assigned by VulDB

CVE-2026-16767Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal

Medium 6.5

In plain English

A medium-severity path traversal in php-zip from Ne-Lexa. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.7%top 47.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Affected products (as reported)

Vendor	Product	Versions
Ne-Lexa	php-zip	4.0.04.0.14.0.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-382660 | Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal vdb-entry, technical-description
VDB-382660 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-16767 | CVE Analysis and Report third-party-advisory
Submit #862203 | Ne-Lexa php-zip 4.0.2 and prior Path Traversal: '../filedir' third-party-advisory
https://github.com/Ne-Lexa/php-zip/issues/100 exploit, issue-tracking
https://github.com/Ne-Lexa/php-zip/ product