Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

PHP can let attackers write arbitrary files via crafted ZIP

CVE-2015-6833 · published 10 years ago
Summary

Certain older versions of PHP mishandle ZIP archives, letting a remote user place ".." in a file name and cause the system to write files anywhere it wants. This could let attackers add or change files on your server, potentially leading to further compromise. Upgrade PHP to a version newer than 5.4.44, 5.5.28, or 5.6.12 to stop the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
php php <= 5.4.43
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.5.7
5.5.8
5.5.9
5.5.10
26 more version ranges
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in ...
Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
5% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published19 Jan 2016
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-6833 · NVD
Track software like this
Free during beta