The vulnerability is an uncontrolled path traversal in the automatic folder creation feature of Lhaz and Lhaz+. When a user extracts an archive that contains a crafted filename, the files are written to directories outside the intended extraction path. This flaw can allow a user to overwrite arbitrary files or place files in privileged locations, thereby compromising the integrity of the system. The weakness is classified as CWE‑22.

The affected products are Chitora soft’s Lhaz and Lhaz+. Version information is not specified in the advisory; all releases that enable the automatic folder creation setting are potentially vulnerable.

The CVSS score is 4.6, indicating a moderate risk. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local, as a user who can trigger archive extraction with crafted file names can exploit the flaw. If the user has sufficient privileges to write to protected directories, the impact could be more severe, potentially allowing privilege escalation or system compromise. In the absence of known public exploits, the risk remains moderate until a patch is released.