CVE-2025-66945 - Vulnerability Analysis

Overview

Zdir Pro 4.x contains a path traversal vulnerability caused by improper handling of crafted ZIP archives in the /api/extract endpoint, letting attackers overwrite arbitrary files and potentially execute code remotely, exploit requires crafted ZIP archive.

Severity & Score

Impact

Attackers can overwrite arbitrary files and potentially execute code remotely, leading to full system compromise.

Mitigation

Update to the latest version with the vulnerability fixed.

References

• https://github.com/kaliworld/Zdir-Pro-Zip-slip-vulnerability/
• https://zeroday.endlessparadox.com/posts/cve-2025-66945/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner