CVE-2026-63436 | zeroturnaround zt-zip up to 1.17.x Destination Boundary Validation Zips.java Zips.get path traversal

November 3, 2026 Yanac

A vulnerability, which was classified as problematic, was found in zeroturnaround zt-zip up to 1.17.x. This impacts the function Zips.get of the file src/main/java/org/zeroturnaround/zip/Zips.java of the component Destination Boundary Validation. Executing a manipulation can lead to path traversal.

This vulnerability is handled as CVE-2026-63436. It is possible to launch the attack on the local host. There is not any exploit available.

You should upgrade the affected component.VulDB Recent EntriesRead More