CVE-2026-6101: Wp Unsafe Zip Extraction Shallow Cleanup
A ZIP file is extracted using `unzip_file()`, followed by a shallow directory listing such as `glob()` or `scandir()` in a loop for validation or cleanup. This pattern is highly insecure because shallow loops do not recursively traverse subdirectories. Attackers can bypass file-type blacklists (e.g., `.php` checks) by placing malicious scripts within a neste
PHPgreprules fetch cve-2026-6101-wp-unsafe-zip-extraction-shallow-cleanup --engine opengrepDescription
A ZIP file is extracted using `unzip_file()`, followed by a shallow directory listing such as `glob()` or `scandir()` in a loop for validation or cleanup. This pattern is highly insecure because shallow loops do not recursively traverse subdirectories. Attackers can bypass file-type blacklists (e.g., `.php` checks) by placing malicious scripts within a neste
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.