CVE-2014-9767: Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before...

Security readout for executives and security teams

This issue affects older PHP and HHVM ZIP extraction code. If an application extracts attacker-supplied ZIP files, a crafted archive could make the server create empty directories outside the intended extraction folder. The cited impact is limited to directory creation, but it still indicates unsafe archive handling and should be removed from internet-facing workflows. Exposure is most likely where legacy PHP or HHVM applications accept ZIP uploads or process ZIP files from users, partners, or remote sources. Systems not using ZipArchive::extractTo or not handling untrusted archives are less likely exposed. Treat as a targeted cleanup item for legacy web stacks, especially public upload portals. It is not listed as actively exploited in the bundle, but outdated PHP or HHVM handling untrusted ZIPs deserves prompt remediation. Mitigation focus: Upgrade PHP beyond 5.4.45, 5.5.29, or 5.6.13 where applicable.; Upgrade HHVM to 3.12.1 or later where applicable.; Check vendor advisories for distribution-specific fixed package versions..

Prepared

Jun 13, 2026, 14:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.