# Wordpress unzip_file path traversal

WordPress unzip_file extracts zip entries with ../ filenames outside the target directory, letting an attacker write arbitrary PHP files to any writable path.

- Payout: hidden
- Severity: medium
- Program: WordPress
- Found by: ajxchapman
- Disclosed: 2020-01-29
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/205481
- Library page: https://bugbountylibrary.com/r/h1%3A205481
- Tags: area:web domain:web impact:integrity impact:rce kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:file-upload vuln:path-traversal

**Target:** unzip_file() in wp-admin/includes/file.php (ZipArchive and PclZip backends)
**Root cause:** Neither _unzip_file_ziparchive nor _unzip_file_pclzip normalizes extracted entry paths or verifies they stay within the $to target directory, so ../ sequences escape the destination.
**Steps:**
1. Craft a zip containing an entry whose filename is `../../../../../../../../../../tmp/poc_file`
2. Pass the zip to unzip_file() with a target directory, e.g. via the Upload Plugin admin function or a plugin calling unzip_file
3. The entry is written to /tmp/poc_file outside the intended $to directory
4. Replace the payload with a .php file and a path into the DocumentRoot to achieve code execution
**How found:** Code review of unzip_file's two extraction backends; noticed no normalization/containment check on entry paths, then tested a ../ entry and confirmed it landed in /tmp. Also noted PHP's native ZipArchive::extractTo is not vulnerable, isolating the flaw to WordPress's wrappers.
**Exploitation:** Attacker supplies a malicious zip to any code path that calls unzip_file() (e.g. plugin upload/extraction features). Entries with ../ filenames are written to arbitrary writable locations; placing a PHP file under the webroot yields code execution. Gallery plugins allowing low-privilege zip uploads are especially exposed.
**Escalation:** Low-privilege zip upload in plugins like NextGen Gallery could let non-admin users reach arbitrary file write and then RCE via PHP in DocumentRoot.
**Insight:** When a framework wraps a safe native API (ZipArchive::extractTo) with its own fallback (PclZip), audit both backends for the safety checks the native one performs; zip-slip containment is a common omission in the fallback path.