JVN#68350834
Lhaz and Lhaz+ vulnerable to path traversal

Overview

Lhaz and Lhaz+ provided by Chitora soft contain a path traversal vulnerability.

Products Affected

• Lhaz versions 2.6.3 and earlier
• Lhaz+ versions 3.6.3 and earlier

Description

Lhaz and Lhaz+ provided by Chitora soft contain the following vulnerability.

• Path traversal (CWE-22)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 4.6
  • CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score 3.3
  • CVE-2026-41530
  • the automatic folder creation feature does not properly handle archive file names.

Impact

When the affected product is configured with the automatic folder creation feature enabled, and a product user tries to extract an archive file which has a crafted file name, then the archived files may be extracted to an unexpected folder.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.
The developer has released the following version to address this vulnerability.

• Lhaz versions 2.6.4
• Lhaz+ versions 3.6.4