CVE-2025-66945 — CRITICAL (9.1)

Q: How severe is CVE-2025-66945?

CVE-2025-66945 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Q: Is there a patch for CVE-2025-66945?

Check the references section above for vendor advisories and patch information. Affected products include: Zdir Zdir.

Vulnerability Description

A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution

CVSS Score

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Zdir	Zdir	>= 4.1.1, <= 4.6.2

Related Weaknesses (CWE)

CWE-787

References

https://github.com/kaliworld/Zdir-Pro-Zip-slip-vulnerability/ExploitThird Party AdvisoryMitigation
https://zeroday.endlessparadox.com/posts/cve-2025-66945/ExploitThird Party Advisory

FAQ

What is CVE-2025-66945?

CVE-2025-66945 is a vulnerability with a CVSS score of 9.1 (CRITICAL). A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended direc...

How severe is CVE-2025-66945?

CVE-2025-66945 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2025-66945?

Check the references section above for vendor advisories and patch information. Affected products include: Zdir Zdir.