PHP Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability - CVE-2021-21706 - Vulnerability Database

PHP

PHP Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability - CVE-2021-21706

Medium

Reference: CVE-2021-21706

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2021-21706

Title: PHP Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) Vulnerability

Overview:

In PHP versions 7.3.x below 7.3.31 7.4.x below 7.4.24 and 8.0.x below 8.0.11 in Microsoft Windows environment ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file thus potentially causing files to be created or overwritten subject to OS permissions.