php-archive-extract-audit

Audit PHP archive extraction by tracing extraction calls and final target paths to identify Zip Slip vulnerabilities. The audit tracks entry name sources, sanitization steps, and extract destinations to verify final target validation against the base directory.

A Zip Slip vulnerability occurs during PHP archive unpacking when unchecked entry names with path traversal sequences write files outside the base directory. It affects extraction via ZipArchive, PharData, or Archive_Tar when destination paths lack proper constraints.

Check ZipArchive extractTo path traversal risks by tracing the extraction call site and verifying base directory constraints. The audit identifies entry name sources, sanitization steps, and validates the final target path against the base directory.

This PHP security audit supports PharData and Archive_Tar extraction alongside ZipArchive. It analyzes archive unpacking flows across these libraries to identify path traversal points and verify final target validation against the base directory.

Archive extraction writes files to unauthorized directories in PHP when entry names containing path traversal sequences are concatenated with the destination without sanitization. The audit traces these entry name sources and detects missing base directory constraints.

Prevent path traversal in PHP archive extraction by enforcing base directory constraints and sanitizing entry names before extraction. The audit provides evidence chains and remediation guidance to ensure final target paths stay within authorized boundaries.