CVE-2021-21706 ZipArchive::extractTo may extract outside of destination dir
Attackers can exploit ZipArchive::extractTo in PHP on Windows to write files outside the intended directory, potentially overwriting critical files or executing code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-21706?
CVE-2021-21706 is a medium-severity path traversal vulnerability in Php Php, published on 4 Oct 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.
Which versions are affected by CVE-2021-21706?
3 open source packages ship an affected version, including libphp, php and php-min. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
libphp Bitnami | From 7.3.0 | 7.3.31, 7.4.24, 8.0.11 |
php Bitnami | From 7.3.0 | 7.3.31, 7.4.24, 8.0.11 |
php-min Bitnami | From 7.3.0 | 7.3.31, 7.4.24, 8.0.11 |
Products include Php Php.
How do I fix CVE-2021-21706?
Upgrade libphp to a fixed version for your release line: 7.3.31, 7.4.24 or 8.0.11.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-21706 being exploited?
There is no known exploitation of CVE-2021-21706 in the wild and no public exploit code.
Other vulnerabilities in Php Php
Sources
Also known as BIT-libphp-2021-21706, BIT-php-2021-21706, BIT-php-min-2021-21706, ECHO-6fd1-b740-5dbb, GHSA-x4g4-47f7-vvq4.