CVE-2021-21706

Description

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Weakness classification

• security@php.net: CWE-24
• nvd@nist.gov: CWE-22

Primary references

• security@php.net — Issue Tracking, Patch, Vendor Advisory
• security@php.net — Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory