Zip slip (ARCH7106)

Key php.security.zip-slip · Severity error · Category security · CWE CWE-22

Writing archive entry paths to disk without validation lets entry names containing ../ write files outside the target directory. Each entry’s destination must be verified to stay within the extraction root.

Incorrect

<?php
$zip = new ZipArchive();
$zip->open($_FILES['archive']['tmp_name']);
$zip->extractTo('/var/www/data');
$zip->close();

Correct

<?php
$dest = '/var/www/data';
$zip = new ZipArchive();
$zip->open($_FILES['archive']['tmp_name']);
for ($i = 0; $i < $zip->numFiles; $i++) {
    $name = $zip->getNameIndex($i);
    $path = realpath($dest) . '/' . $name;
    if (str_contains($name, '..') || !str_starts_with($path, realpath($dest) . '/')) {
        continue;
    }
    $zip->extractTo($dest, $name);
}
$zip->close();

Fix

Verify each entry’s resolved destination stays inside the extraction directory; skip entries containing ...