A security issue has been found in PHP on Windows prior to 8.0.11 and 7.4.24. It is possible to construct ZIP archives containing files which are placed outside the destination directory given to ZipArchive::extractTo() because the implementation of php_zip_make_relative_path() doesn't properly cater to absolute directories on Windows; a path starting with a slash is not an absolute path on Windows, but rather a relative path pointing to the current volume.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
php php |
Vulmon