CVE-2025-66945Disclosure(zdir / zdir)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the intended directory, leading to arbitrary file overwrite and potentially remote code execution

zdir CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-787

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

zdir

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-03-03); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

zdir

Products

zdir

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

The Hacker Wire@TheHackerWire219d
Disclosure
🔴 CVE-2025-66945 - Critical A path traversal vulnerability exists in the ZIP extraction API of Zdir Pro 4.x. When a crafted ZIP archive is processed by the backend at /api/extract, files may be written outside the i... https://www.thehackerwire.com/vulnerability/CVE-2025-66945/ https://t.co/i6UHP5qVQo
Post summary
The tweet announces a critical path traversal flaw in Zdir Pro 4.x’s ZIP extraction API, detailing the affected endpoint and the potential for files to be written outside the intended directory.
00000108
121 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds220d
Disclosure
CVE-2025-66945 Path Traversal in Zdir Pro 4.x ZIP Extraction API Enables... https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-66945 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces a path traversal vulnerability in Zdir Pro 4.x ZIP Extraction API, linking to a vulnerability details page but providing no PoC, exploit, or patch information.
0000097
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	zdir	zdir	-	-	-

Explore more

Back to dashboard zdir CVEs zdir vulnerabilities