CVE-2026-16767 | A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2.… | CVSS 6.5 MEDIUM

Description

A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing a manipulation of the argument entryName results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metadata

CVE ID: CVE-2026-16767
State: PUBLISHED
Assigner: VulDB
Reserved: 2026-07-23 14:25 UTC
Published: 2026-07-23 22:15 UTC
Last updated: 2026-07-23 22:15 UTC
Primary CWE: CWE-22
Path Traversal
Vendor / Product: Ne-Lexa / php-zip
Sources: cve.org · NVD

Severity & Metrics

6.5 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

Affected products (1)

Vendor	Product	Platform	Versions
Ne-Lexa	php-zip	—	4.0.0, 4.0.1, 4.0.2

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	Path Traversal

CVSS scores (4)

Score	Severity	Version	Source	Vector
6.9	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
6.5	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
6.5	MEDIUM	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
6.4	N/D	2.0	cna	AV:N/AC:L/Au:N/C:N/I:P/A:P/E:POC/RL:ND/RC:UR

References (6)

VDB-382660 | Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal https://vuldb.com/vuln/382660
VDB-382660 | CTI Indicators (IOB, IOC, TTP, IOA) https://vuldb.com/vuln/382660/cti
CVE-2026-16767 | CVE Analysis and Report https://vuldb.com/cve/CVE-2026-16767
Submit #862203 | Ne-Lexa php-zip 4.0.2 and prior Path Traversal: '../filedir' https://vuldb.com/submit/862203
https://github.com/Ne-Lexa/php-zip/issues/100
https://github.com/Ne-Lexa/php-zip/