PT-2026-22784 · Zdir Pro · Zdir Pro

Published 2026-03-03 · Updated 2026-03-04 · CVE-2025-66945

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zdir Pro versions 4.x

Description A path traversal issue exists in the ZIP extraction functionality of Zdir Pro. Processing a specially crafted ZIP archive via the backend at /api/extract can allow files to be written outside the intended directory. This could lead to arbitrary file overwrites and potentially remote code execution. The vulnerable component is the ZIP extraction API. The vulnerable API endpoint is /api/extract.

Recommendations Apply updates to address the path traversal issue in the ZIP extraction functionality.

Exploit

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-66945

Affected Products

Zdir Pro

References · 7

• 🔥 https://zeroday.endlessparadox.com/posts/cve-2025-66945 · Exploit
• 🔥 https://github.com/kaliworld/Zdir-Pro-Zip-slip-vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2025-66945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66945 · Security Note
• https://t.me/cveNotify/154122 · Telegram Post
• https://twitter.com/TheHackerWire/status/2029258799383761023 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2028983104388333624 · Twitter Post