A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Mar 3, 2026 · NIST NVD

   Detected

   A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution

2. Jun 17, 2026 · NIST NVD

   Updated

   A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution

Affected

• cpe zdir/zdirversion unspecified

Sources

• NIST NVDVulnerability recordCVE-2025-66945

  A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution

  nvd.nist.gov

References

• Exploit · github.com
• Exploit · zeroday.endlessparadox.com