CVE-2025-66945 - Vulnerability Analysis

Overview

Zdir Pro 4.x contains a path traversal vulnerability caused by improper handling of crafted ZIP archives in the /api/extract endpoint, letting attackers overwrite arbitrary files and potentially execute code remotely, exploit requires crafted ZIP archive.

Severity & Score

Impact

Attackers can overwrite arbitrary files and potentially execute code remotely, leading to full system compromise.

Mitigation

Update to the latest version with the vulnerability fixed.

References

• https://github.com/kaliworld/Zdir-Pro-Zip-slip-vulnerability/
• https://zeroday.endlessparadox.com/posts/cve-2025-66945/

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 4, 2026

🔴 CVE-2025-66945 - Critical (9.1) A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and p... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-66945/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner