Critical Vulnerability in PHP 8.1: ZipArchive Directory Traversal Risk
Summary
UBUNTU-CVE-2021-21706: In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP fil... Affects php8.1 versions < 8.1.0-1. Fixed in 8.1.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development. PHP 8.1 introduces several enhancements and features aimed at improving performance and security. However, it is susceptible to vulnerabilities, including a critical issue in the ZipArchive class that can lead to unauthorized file access when extracting ZIP files.
Vulnerability Detail
In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24, and 8.0.x below 8.0.11, a vulnerability exists in the ZipArchive::extractTo method. This flaw allows an attacker to trick the function into writing files outside the intended target directory when extracting ZIP files. This can lead to unauthorized file creation or overwriting, depending on the operating system's permissions. The vulnerability is particularly concerning in Microsoft Windows environments, where it can be exploited to compromise system integrity.
How To Fix
Minimum fixed version
8.1.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the ZipArchive::extractTo method with untrusted ZIP files. Always validate and sanitize input files before processing them to prevent potential exploitation.
Conclusion
The vulnerability in PHP 8.1 related to the ZipArchive::extractTo method poses significant risks, particularly in Windows environments. It is crucial for users to update their PHP installations to the latest patched version to mitigate these risks effectively. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for php8.1 →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24, and 8.0.x below 8.0.11 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized file creation or overwriting, potentially compromising sensitive data and system integrity.
Yes, updating to the patched version of PHP (8.1.0-1 or later) is the permanent fix for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for php8.1.
