Loading story…
A high-severity directory traversal flaw, CVE-2026-17524, has been disclosed in the zip-lib package before version 1.1.0, allowing attackers to bypass extraction safeguards and write files outside the intended destination folder. The bug stems from cached path-validation results during archive extraction: zip-lib checks the isOutsideTargetFolder condition only when an initial directory symlink is created, enabling later archive entries to evade traversal protections. The issue is mapped to CWE-22 and carries a CVSS 3.1 score reflecting network-exploitable impact with high confidentiality risk.
The vulnerability fits the long-running Zip Slip class of archive extraction bugs, in which crafted archive entries such as ../../ paths can overwrite arbitrary files and potentially lead to remote code execution across ZIP, TAR, JAR, CPIO, and other formats. Security research has shown this pattern affects thousands of projects across multiple ecosystems when extraction logic concatenates archive entry names without robust validation, and offensive testing tools such as Archive Pwn have made it easier to generate malicious archives using traversal paths, symlink abuse, Unicode tricks, and other bypass techniques. The zip-lib disclosure underscores that archive handling remains a persistent software supply chain and application security risk even years after the original Zip Slip wave of fixes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Snyk newly received CVE-2026-17524 for a directory traversal vulnerability in zip-lib versions before 1.1.0. The flaw stems from cached path validation during extraction that can let attackers bypass protections against writing outside the target folder.
Pentagrid released Archive Pwn, a Python-based tool for generating malicious archive files to test for path traversal and related archive extraction vulnerabilities. The tool supports multiple archive formats and attack techniques including traversal, symlink abuse, Unicode normalization issues, and denial-of-service patterns.
Snyk publicly disclosed Zip Slip, a widespread archive extraction flaw that can enable arbitrary file overwrite and potentially remote code execution via directory traversal paths in crafted archives. The disclosure reported impact across thousands of projects and multiple ecosystems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcepentagrid.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in the widely used open-source compression utility 7-Zip have been disclosed, allowing attackers to achieve remote code execution by leveraging specially crafted ZIP archives. The flaws, identified as CVE-2025-11001 and CVE-2025-11002, were reported by Trend Micro’s Zero Day Initiative and affect multiple builds of 7-Zip. These vulnerabilities arise from improper parsing of symbolic links within ZIP files, enabling a malicious archive to escape its intended extraction directory and write files to arbitrary locations on the victim’s system. If exploited, this directory traversal can be chained to execute arbitrary code with the privileges of the user running 7-Zip, potentially compromising the entire Windows environment. Both vulnerabilities have been assigned a CVSS base score of 7.0, reflecting their significant risk. Exploitation requires minimal user interaction; simply opening or extracting a malicious ZIP file is sufficient to trigger the attack. The vulnerabilities were quietly patched in 7-Zip version 25.00, released on July 5, 2025, but details were not publicly disclosed until October, leaving users unaware and exposed for several months if they had not updated. The lack of an automatic update mechanism in 7-Zip exacerbates the risk, as many users may not be running the latest, patched version. The vulnerabilities specifically allow attackers to overwrite or plant payloads in sensitive system paths, which can be used to hijack execution flow and escalate privileges. Security advisories emphasize the importance of updating to version 25.00 or later to mitigate these risks. The flaws highlight the ongoing challenges in securing widely deployed open-source tools, especially those lacking robust update mechanisms. Organizations relying on 7-Zip for file compression and extraction should prioritize patching and consider additional controls to limit the impact of potential exploitation. The vulnerabilities underscore the need for user awareness regarding the risks of opening files from untrusted sources. Security researchers warn that similar directory traversal and symlink handling issues may exist in other archiving tools, warranting broader scrutiny. The incident demonstrates the value of coordinated vulnerability disclosure and timely patch adoption. Enterprises are advised to audit their environments for outdated 7-Zip installations and deploy the latest version as a matter of urgency. The disclosure also serves as a reminder for software maintainers to implement secure default behaviors and consider automated update features to protect end users.
Jul 12, 2026
A newly published archive-parsing weakness, **CVE-2026-0866** (dubbed **“Zombie ZIP”**), enables attackers to craft **malformed ZIP files** that can evade many antivirus and EDR scanners by manipulating ZIP header metadata. The technique sets the ZIP entry’s compression method to `STORED` while the embedded content remains **DEFLATED**, causing security tools that trust the header to **skip decompression and scanning**, resulting in false negatives. The malformed archives also typically fail to open or extract with standard ZIP utilities, which may surface errors such as CRC or unsupported method failures. Technical analysis shows the inconsistency can be detected by inspecting ZIP record metadata (e.g., `STORED` entries where compressed and uncompressed sizes differ) and by using tooling that bypasses standard ZIP libraries to parse raw records and forcibly decompress data. The SANS ISC write-up demonstrates analysis workflows and updates to *zipdump.py* (including a `forcedecompress` capability) to recover the hidden payload (illustrated with an embedded **EICAR** test file), while reporting indicates real-world abuse would likely pair the malformed archive with a **custom loader** that ignores the falsified header and directly extracts/decompresses the concealed content for execution.
Jun 29, 2026
Researchers disclosed **CVE-2026-48095**, a critical heap buffer overflow in 7-Zip affecting version `26.00` and earlier that can lead to application crashes, denial of service, or arbitrary code execution. The bug, reported by Jaroslav Lobačevski of GitHub Security Lab and tracked in advisory `GHSL-2026-140`, resides in the NTFS archive handler’s `CInStream::GetCuSize()` logic, where an under-allocation can shrink a buffer to 1 byte before a later operation writes up to 256 MB of attacker-controlled data into it. The resulting heap corruption can overwrite adjacent objects, including a stream object’s **vtable** pointer, creating a path to code execution. The vulnerability can be triggered simply by opening a specially crafted file because 7-Zip uses signature-based fallback detection and may route files disguised as `.7z`, `.zip`, or `.rar` into the vulnerable NTFS parser regardless of extension. Reports say both 32-bit and 64-bit builds are affected, with 64-bit systems that have sufficient memory more likely to reach reliable code execution, while lower-memory systems may instead crash. Public disclosure included technical details and a Python proof-of-concept generator, raising the risk of weaponization; the issue carries a **CVSS 3.1 score of 8.8**, and users are being urged to update 7-Zip and avoid opening untrusted archives.
Jun 29, 2026