CVE-2021-21706: PHP

Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days.

In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or overwritten, subject to OS permissions.

Affected products

• PHP PHP: from 7.3.0, before 7.3.31 (fixed in 7.3.31); from 7.4.0, before 7.4.24 (fixed in 7.4.24); from 8.0.0, before 8.0.11 (fixed in 8.0.11)

Published 2021-10-04. Last modified 2026-06-17.