Answer in brief
CVE-2026-63499 records a Medium severity (CVSS 6.9) vulnerability in zt-zip: ZipUtil.unpack can change file permissions of output directory. The current sources do not mark it as known exploited. The current feed maps zeroturnaround/zt-zip (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.9. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps zeroturnaround/zt-zip (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| zeroturnaround/zt-zipgeneric | <1.18.1 | 1.18.1 |
Published upstream
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 3, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 3, 2026
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ resolves to that directory itself. Because the path traversal checks permit self-referencing entries that do not escape the destination, the unpacker's permission-handling path can replace restrictive output-directory permissions with attacker-supplied permissions. This affects applications that unpack untrusted ZIP files, and POSIX systems demonstrate the issue directly, while ZTFilePermissionsUtil.fetchDefaultStrategy provides fallback permission handling on other supported systems. This issue is fixed in version 1.18.1.
Quoted source text, attributed separately from HOL analysis.