CVE-2021-21706

score

<0.1

cvss

5.3

epss

1.4%

published

2021-10-04

kev added

—

first seen

2026-10-21

PHP versions 7.3.x < 7.3.31, 7.4.x < 7.4.24, and 8.0.x < 8.0.11 in Windows contain a path traversal caused by ZipArchive::extractTo when extracting ZIP files, letting attackers write files outside the target directory, exploit requires specific ZIP files.