CVE-2026-41530: Lhaz Path Traversal Vulnerability

CVE-2026-41530 Overview

CVE-2026-41530 is a path traversal vulnerability [CWE-22] in the automatic folder creation feature of Lhaz and Lhaz+, archive utilities provided by Chitora soft. When a user extracts an archive that contains a crafted file name while the automatic folder creation feature is enabled, the archived files can be written to an unintended directory outside the designated extraction folder. An attacker who can deliver a malicious archive to a target user can place files in arbitrary locations writable by that user. Exploitation requires local user interaction to open the crafted archive.

Critical Impact
A crafted archive file name can cause Lhaz or Lhaz+ to extract contents to attacker-controlled paths, enabling file placement outside the intended extraction directory.

Affected Products

Lhaz (Chitora soft) — automatic folder creation feature enabled
Lhaz+ (Chitora soft) — automatic folder creation feature enabled
Specific affected versions: refer to the vendor advisory

Discovery Timeline

2026-05-12 - CVE-2026-41530 published to the National Vulnerability Database (NVD)
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-41530

Vulnerability Analysis

The flaw resides in how Lhaz and Lhaz+ handle file names embedded inside an archive when the automatic folder creation feature is active. The extractor uses entry names to construct destination paths but does not adequately validate or canonicalize them before writing files. An archive crafted with traversal sequences such as ..\ or absolute path components can redirect file writes to locations outside the intended output folder.

The attack vector is local and requires user interaction, as the victim must open the malicious archive in Lhaz or Lhaz+. No authentication or elevated privileges are required, and the impact is limited to integrity — files can be created or overwritten in directories the user can write to. Confidentiality and availability are not directly affected.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The automatic folder creation logic trusts the file name field of the archive entry and joins it to the output path without rejecting parent-directory references or absolute paths. This allows path components within the archive to escape the extraction root.

Attack Vector

An attacker constructs an archive in which one or more entries embed path traversal sequences in their stored names. The attacker delivers the archive through email, web download, or shared storage. When the victim extracts the archive in Lhaz or Lhaz+ with automatic folder creation enabled, the extractor writes the entry to the attacker-specified relative or absolute path. Useful targets include user startup folders, configuration directories, or application data paths, where writing a file may lead to code execution or configuration tampering on subsequent user actions.

Verified proof-of-concept code is not available in the referenced advisories. See the JVN Security Advisory and Chitora Analysis on JVN68350834 for vendor-provided technical details.

Detection Methods for CVE-2026-41530

Indicators of Compromise

Files created by Lhaz.exe or Lhaz+.exe outside of user-configured extraction directories.
Archive files (.zip, .lzh, .7z, .tar, and other formats supported by Lhaz) containing entry names with ..\, ../, or absolute path prefixes.
Unexpected files appearing in sensitive user paths such as %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup shortly after archive extraction.

Detection Strategies

Inspect archives prior to extraction using a separate tool that lists entry names, and flag any entry containing .. segments or drive letters.
Monitor process file-write telemetry for Lhaz binaries writing outside the user's Downloads or designated extraction folders.
Correlate archive open events with subsequent file creation in autorun, scheduled task, or shell extension locations.

Monitoring Recommendations

Enable endpoint file-creation auditing for user-writable persistence locations and alert on writes initiated by archive utilities.
Log command-line and parent-process relationships for processes spawned from files written by Lhaz or Lhaz+.
Track installations and versions of Lhaz and Lhaz+ across the fleet to ensure patched releases are deployed.

How to Mitigate CVE-2026-41530

Immediate Actions Required

Apply the fixed version of Lhaz and Lhaz+ published by Chitora soft as soon as it is available from the vendor.
Disable the automatic folder creation feature in Lhaz and Lhaz+ until the patch is applied.
Treat archives received from untrusted sources as suspicious and scan them before extraction.

Patch Information

Chitora soft has published advisory information for this vulnerability. Refer to the Chitora Analysis on JVN68350834 and the JVN Security Advisory for the current fixed version and update instructions.

Workarounds

Disable the automatic folder creation option and extract archives only into dedicated, non-sensitive directories.
Use an alternate archiver that performs strict path canonicalization for archives from untrusted sources.
Restrict write permissions for end-user accounts on sensitive locations such as startup and application data folders where feasible.

bash

# Example: inspect archive entries for traversal sequences before extraction
unzip -l suspicious.zip | grep -E '\.\./|\.\.\\|^[A-Za-z]:\\'