Skip to main content

decompress CVE-2026-39245

| EUVDEUVD-2026-42769 MEDIUM
Path Traversal (CWE-22)
2026-07-09 mitre GHSA-qcj4-cj8p-fhf4
Path Traversal Red Hat N A Suse
6.2
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
vuln.today AI
7.5 HIGH

Decompress is primarily used in web services and CI pipelines that accept network-supplied archives, making AV:N more representative than NVD's AV:L; no privileges required to supply a crafted archive.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Red Hat
6.2 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

3
Analysis Generated
Jul 10, 2026 - 16:36 vuln.today
CVSS changed
Jul 10, 2026 - 16:22 NVD
6.2 (MEDIUM)
CVE Published
Jul 09, 2026 - 00:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and the extraction path validation (index.js line 106) use String.indexOf() to verify the resolved path is within the output directory: realDestinationDir.indexOf(realOutputPath) ! 0. This check is flawed because it does not enforce a path separator boundary. For example, "/tmp/app_config".indexOf("/tmp/app") returns 0, incorrectly passing the check even though /tmp/app_config is outside /tmp/app. Combined with the unvalidated symlink creation in the same package, an attacker can write arbitrary files to directories adjacent to the extraction target. This is a bypass of the fix for CVE-2020-12265. The correct check requires appending a path separator: realParentPath.indexOf(realOutputPath + path.sep) ! 0.

AnalysisAI

Directory traversal and arbitrary file write in the decompress npm package (versions before 4.2.2) stem from a prefix-confusion flaw in path boundary validation using String.indexOf() at two locations in index.js. An attacker supplying a crafted archive can write files to filesystem directories adjacent to the intended extraction target - for example, escaping /tmp/app into /tmp/app_config - bypassing both the safeMakeDir function and the extraction path validation. This is a confirmed bypass of the prior fix for CVE-2020-12265; no public exploit has been identified at time of analysis and EPSS is low at 0.26% (17th percentile), though the integrity impact is rated high by CVSS.

Technical ContextAI

The decompress npm package (https://www.npmjs.com/package/decompress, https://github.com/kevva/decompress) is a Node.js library for extracting zip, tar, and bzip2 archives commonly used in build toolchains and CI pipelines. The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and manifests as a classic string-prefix confusion bug. At index.js line 29 (safeMakeDir) and line 106 (extraction path validation), the check realDestinationDir.indexOf(realOutputPath) !== 0 is used to verify a resolved destination path remains within the output directory. Because String.indexOf() performs a plain substring match with no awareness of path separator boundaries, a path like /tmp/app_config satisfies the check against realOutputPath /tmp/app (indexOf returns 0), even though /tmp/app_config is not a subdirectory of /tmp/app. The correct fix, implemented in 4.2.2, appends path.sep to the output path before comparison. Compounding the issue, the package also performs unvalidated symlink creation, which can be chained with this traversal to write to arbitrary filesystem locations. CPE data from NVD for this CVE is non-specific (cpe:2.3:a:n/a:n/a), so version range is sourced from the CVE description directly.

RemediationAI

Upgrade the decompress npm package to version 4.2.2 or later, which implements the corrected path boundary check by appending path.sep before comparison. Run npm install decompress@latest or pin to >=4.2.2 in package.json and lock files. The npm registry page is at https://www.npmjs.com/package/decompress and the GitHub repository tracking this issue is https://github.com/kevva/decompress/issues/115. If an immediate upgrade is not possible, a compensating control is to wrap all calls to decompress with application-level path validation that checks both string prefix and separator boundary before writing any extracted entry. Additionally, disable symlink following within archives if the application does not require it, as the unvalidated symlink creation in the same package can be chained with this traversal. Restricting the filesystem permissions of the extraction process to a confined directory (e.g., via a dedicated low-privilege user or container) limits the blast radius of successful exploitation but does not eliminate the vulnerability.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-39245 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy