Skip to main content

extract-zip CVE-2026-19693

| EUVDEUVD-2026-60194 HIGH
Path Traversal (CWE-22)
2026-08-17 22e2d327-25fe-45d7-9f0c-dcd23b7108df GHSA-7pqw-9j4j-h8q3
Path Traversal Red Hat
8.1
CVSS 3.1 · Vendor: 22e2d327-25fe-45d7-9f0c-dcd23b7108df
Share

Severity by source

Vendor (22e2d327-25fe-45d7-9f0c-dcd23b7108df) PRIMARY
8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
vuln.today AI
8.1 HIGH

Network-delivered crafted archive requires no attacker privileges; user must trigger extraction (UI:R); arbitrary file write yields high integrity and availability impact with no confidentiality effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (22e2d327-25fe-45d7-9f0c-dcd23b7108df).

CVSS VectorVendor: 22e2d327-25fe-45d7-9f0c-dcd23b7108df

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 17, 2026 - 14:36 vuln.today
CVE Published
Aug 17, 2026 - 14:20 cve.org
HIGH 8.1

DescriptionCVE.org

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

AnalysisAI

Arbitrary file write outside the extraction destination is possible in extract-zip 2.0.1 and earlier due to an incomplete symlink containment check that validates only the parent directory of each archive entry, not the entry's own final path component. An attacker who can supply a crafted ZIP archive - containing a symlink followed by a same-named regular file - causes extract-zip to plant the symlink during extraction and then write attacker-controlled content through it to any path writable by the process. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target environment uses the extract-zip npm package at version 2.0.1 or earlier to process a ZIP archive containing at minimum two entries: a symlink entry whose name passes the parent-directory containment check but whose target resolves outside the destination, followed by a regular file entry with the identical archive name. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) reflects a realistic threat model: the attack is network-delivered, requires no attacker-side privileges, and is mechanically straightforward once a crafted archive is constructed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patched version of extract-zip has been identified in the available intelligence data; references point only to the repository and npm listing without a tagged release or security advisory documenting a fix. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all applications and services using extract-zip 2.0.1 or earlier and document their operational context, privilege levels, and data exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-19693 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy