CVE-2026-80427
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and source paths are passed without a -- delimiter, so any source entry starting with a hyphen is interpreted as an option. zip accepts -T to test the archive and -TT to name the test command, so a source list containing those and a command string causes zip to run that command via shell. An application passing untrusted file names to bestzip can execute arbitrary commands.
Risk Assessment
An attacker can execute arbitrary commands in the context of the application, leading to full system and data compromise.
Recommendation
Update bestzip to version 2.2.6 or 3.0.2, which add the -- delimiter. If you cannot update, sanitize file names before passing them to bestzip.
Other vulnerabilities in bestzip
Original NVD description (English source)
bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name the command used to perform that test, so a source list containing those two entries and a command string causes zip to run that command through a shell once the archive has been written. An application that passes a file name or path it received from an untrusted source into the bestzip API therefore executes a command of the supplier's choosing. Versions 2.2.6 and 3.0.2 add the delimiter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS