CVE-2021-21706

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Score

CVSS 3.1 6.5 Medium

Status

Modified - security@php.net

Published

2021-10-04

Last modified

2024-09-16

Weaknesses

CWE-22, CWE-24

Affected products

• Php (Php)
• Php (Php Group)

References

• https://bugs.php.net/bug.php?id=81420
• https://security.netapp.com/advisory/ntap-20211029-0007/