{"apiVersion":"1.0","identifier":"CVE-2026-80427","description":"bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and the caller-supplied source paths are passed to the child process with no -- delimiter between them, so any source entry beginning with a hyphen is interpreted by zip as an option rather than a file name. zip accepts -T to test the finished archive and -TT to name the command used to perform that test, so a source list containing those two entries and a command string causes zip to run that command through a shell once the archive has been written. An application that passes a file name or path it received from an untrusted source into the bestzip API therefore executes a command of the supplier-s choosing. Versions 2.2.6 and 3.0.2 add the delimiter.","publishedAt":"2026-08-26T16:16:44","lastModifiedAt":"2026-08-26T17:17:26","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80427","cvssScore":8.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00152,"riskScore":0.85,"affectedProduct":"bestzip","affectedVersions":"<2.2.6","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-80427","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-80427","en":"https://www.redsauce.net/en/cves/CVE-2026-80427","fr":"https://www.redsauce.net/fr/cves/CVE-2026-80427","pt":"https://www.redsauce.net/pt/cves/CVE-2026-80427","de":"https://www.redsauce.net/de/cves/CVE-2026-80427","sk":"https://www.redsauce.net/sk/cves/CVE-2026-80427","el":"https://www.redsauce.net/el/cves/CVE-2026-80427"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-80427"}}