ZI
Product
zip2
5
CVEs
0
On KEV
10.0
Max CVSS
5
New 30D
Severity mix
Critical 1High 3Medium 1Low 0
Watch
Add zip2 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-115909 New | 7.5 | Oct 26 | zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction Affected: >= 1.3.0, < 9.0.0 |
| CVE-2026-115907 New | 7.5 | Oct 26 | zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size Affected: >= 5.1.0, < 9.0.0 |
| CVE-2026-115908 New | 7.4 | Oct 26 | zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) Affected: >= 7.2.0, < 9.0.0 |
Showing 3