Description
A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Path traversal allowing unauthorized file extraction and potential confidentiality breach.
Action: Immediate Patch
AI Analysis

Impact

The flaw resides in the ArchiveZip::extract method of kiwilan php-archive, affecting releases up to 2.3.02. A crafted input can cause the extractor to traverse directories and save files outside the intended target folder. This enables an attacker to overwrite or read arbitrary files on the host, potentially compromising sensitive data or serving further exploits. The weakness is a classic path‑traversal problem (CWE‑22).

Affected Systems

Products impacted are kiwilan php-archive versions up to 2.3.02. No specific sub‑components are listed beyond the ArchiveZip extractor. The vulnerability exists in the Extraction component of the library.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity. Exploitation is remotely achievable, and public proof‑of‑concept code is available. EPSS is not disclosed, and the issue is not in the CISA KEV catalog, but the public availability of the exploit increases the realistic threat. An attacker can leverage this flaw to read or modify arbitrary files on a system that uses the vulnerable extraction routine.

Generated by OpenCVE AI on October 20, 2026 at 06:34 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for an updated release of kiwilan php-archive that removes the path traversal flaw; if none is available, contact the vendor again or seek third‑party security patches.
  • If updating is not possible, configure the application to disallow remote calls to ArchiveZip::extract or to run the extraction in a restricted container process with minimal filesystem access.
  • Implement input validation to ensure extraction paths are confined to a predefined directory and reject any candidate paths containing '..' or absolute paths before invoking the extractor.
  • Enhance monitoring of file system changes in the extraction target directory and alert on unexpected writes or unanticipated file paths.

Generated by OpenCVE AI on October 20, 2026 at 06:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 21:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title kiwilan php-archive Extraction ArchiveZip.php extract path traversal
First Time appeared Kiwilan
Kiwilan php-archive
Weaknesses CWE-22
CPEs cpe:2.3:a:kiwilan:php-archive:*:*:*:*:*:*:*:*
Vendors & Products Kiwilan
Kiwilan php-archive
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Kiwilan Php-archive
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T21:00:23.649Z

Reserved: 2026-10-19T14:09:12.443Z

Link: CVE-2026-112302

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-19T21:17:07.033

Modified: 2026-10-19T21:17:07.033

Link: CVE-2026-112302

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T06:45:12Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')