CVE-2014-9767: Hiphop Virtual Machine For PHP Project Hiphop Virtual Machine For PHP

Medium severity, CVSS 4.3. EPSS: 4.7% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and ext/zip/ext_zip.cpp in HHVM before 3.12.1 allows remote attackers to create arbitrary empty directories via a crafted ZIP archive.

Affected products

• Hiphop Virtual Machine For PHP Project Hiphop Virtual Machine For PHP: up to and including 3.12
• PHP PHP: up to and including 5.4.45; version 5.5.0 only; version 5.5.1 only; version 5.5.2 only; version 5.5.3 only; version 5.5.4 only; …

Published 2016-05-22. Last modified 2026-06-17.