Archives
Packing and unpacking ZIP files without shell access.
Creating an archive
Select one or more items — files, folders, or a mix — and choose Download as ZIP from the toolbar or the context menu. The selection is packed and sent to you as a single archive.
This is the standard way to pull a whole folder down in one go, and it needs the archive command plus download.
Extracting an archive
Right-click a .zip file and choose Extract. Its contents are unpacked into the folder the archive sits in.
Extraction requires the extract command, a writable root, and an unprotected destination.
Zip-Slip is blocked
An archive can contain entries whose names carry a path — ../../configuration.php, say. Extracted naively, that entry escapes the target folder and overwrites a file elsewhere on the server. The attack is known as Zip-Slip, and it is one of the most common ways a file manager gets turned into a remote-code-execution hole.
Next File Manager resolves and checks every entry individually during extraction, not the archive as a whole. An entry that would land outside the destination folder is refused, and the rest of the archive is unaffected. The same canonicalisation the file browser uses for direct paths — resolving .., following symlinks, folding case on filesystems that ignore it — applies to archive entries.
Protection applies inside archives too
A ZIP download is a read of every file it contains, so it is gated the same way a direct download is.
Concretely: a user who cannot download configuration.php directly cannot obtain it by selecting its parent folder and asking for an archive. Secret files — configuration.php and its backups, .env and .env.*, *.key, *.pem, .htpasswd — are refused below Super User whichever route you take.
This matters because "download the folder as a ZIP" is the obvious way around a per-file block, and a file manager that gates only the direct route has not really gated anything.
See Protection.
Requirements and limits
- PHP's
zipextension must be available. It is present on essentially every modern host, but without it archive create and extract are unavailable. - Large archives are bound by PHP's execution time. Packing several gigabytes into a ZIP is real work;
max_execution_timeis the usual ceiling on shared hosting. - ZIP only.
.tar,.gz,.7zand.rarare recognised as archive types by the browser's filters, but create and extract handle ZIP. - Archive operations are logged, with the acting user, the place and the path. See Activity log.