CVE-2025-66945: A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files…

PriorityP260critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EPSS

0.53%

40.8th percentile

A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution

Affected

1 ranges

Vendor	Product	Version range	Fixed in
zdir	zdir	4.1.1 – 4.6.2	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.