CVE-2026-112302 is a path traversal vulnerability in the ZIP extraction function of the kiwilan php-archive PHP library. Versions up to 2.3.02 are affected.
A public exploit is circulating per VulDB. No vendor fix is available, and kiwilan has not responded to the disclosure.