extract.php read ZIP entry filenames directly from the archive's local file headers and used them unvalidated in mkdir() and fopen() calls during extraction. A crafted entry name containing ".." segments or an absolute path (e.g. "../../../../etc/cron.d/x" or "/var/www/other-site/shell.php") could therefore write files outside the intended destination directory, commonly known as a Zip Slip vulnerability.

This adds isPathTraversalAttempt(), which rejects entry names that are absolute (Unix root, Windows drive letter, or UNC path) or contain a ".." path segment. The check runs on the raw entry name before addPath is prepended, and reuses the existing $isBannedFile / skip-and-seek mechanism already used for "." and ".." basenames and the skipFiles list, so rejected entries are safely skipped without disrupting the ZIP read pointer.

No behavior change for well-formed archives.

Pull Request resolves # .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

Added a new private method isPathTraversalAttempt() to ZIPExtraction in administrator/components/com_joomlaupdate/extract.php, and one additional check in readFileHeader() that marks entries as banned (using the existing $isBannedFile skip logic) when the raw entry filename is an absolute path or contains a .. path segment.

Testing Instructions

1. Apply this patch to a Joomla installation.
2. Craft a test ZIP archive containing an entry with a path-traversal name, e.g. ../../../evil.php, an absolute path /tmp/evil.php, or a Windows-style C:\evil.php.
3. Also include a normal, well-formed entry, e.g. administrator/components/com_example/example.php, in the same archive.
4. Trigger extract.php against this archive (e.g. via the update flow, or by calling it directly with the required password/task parameters).
5. Confirm the malicious entries are skipped (no file is written outside the destination directory) and the well-formed entry extracts normally to the expected path.

Actual result BEFORE applying this Pull Request

A ZIP entry with a ..-containing or absolute path name is extracted using its literal, unvalidated path, allowing mkdir()/fopen() calls to create directories and write files outside the intended extraction root.

Expected result AFTER applying this Pull Request

Entries with .. segments or absolute paths are detected before extraction and skipped, consistent with how other banned entries (e.g. ./.. basenames, skipFiles list) are already handled. Well-formed archives extract unchanged.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:
• No documentation changes for guide.joomla.org needed
• Pull Request link for manual.joomla.org:
• No documentation changes for manual.joomla.org needed