CVE-2021-21706: ZipArchive::extractTo may extract outside of destination dir

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-04 · updated 2026-06-17
Weakness: CWE-24

Description

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Affected products

PHP: from 7.3.0 before 7.3.31; from 7.4.0 before 7.4.24; from 8.0.0 before 8.0.11 — fixed in 7.3.31, 7.4.24, 8.0.11

How to fix

Upgrade to a fixed version: PHP 7.3.31, 7.4.24, 8.0.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-21706 or the next vulnerability affects your stack