Skip to content
OpenAdvisories
High VA-26-177-01 1 CVE

extract-zip unvalidated symlink path traversal

Published Jun 26, 2026 · Updated Jun 26, 2026

Vendor: max-mapper Product: extract-zip

Summary

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

Vulnerabilities 1

  • High 8.1
    CVE-2026-56876 Public exploit

    extract-zip unvalidated symlink path traversal

    extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to p…

    max-mapper extract-zip node-extract-zip extract-zip Debian Ubuntu npm

Revision history

  1. #1.0.0

    Initial publication