Skip to main content

extract-zip CVE-2026-56876

| EUVDEUVD-2026-39812 HIGH
Path Traversal (CWE-22)
2026-06-26 cisa-cg GHSA-jmr9-qjv8-65gv
Path Traversal Red Hat Suse Extract Zip
8.6
CVSS 4.0 · Vendor: cisa-cg
Share

Severity by source

Vendor (cisa-cg) PRIMARY
8.6 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.1 HIGH

Remote attacker-supplied archive (AV:N) needs no privileges (PR:N) but requires the app to extract it (UI:R); arbitrary read and write give C:H/I:H, no availability impact, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (cisa-cg).

CVSS VectorVendor: cisa-cg

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

5
Analysis Updated
Jun 26, 2026 - 18:30 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 26, 2026 - 18:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 26, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Jun 26, 2026 - 18:22 NVD
8.1 (HIGH) 8.6 (HIGH)
Analysis Generated
Jun 26, 2026 - 17:50 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 27,734 npm packages depend on extract-zip (1,802 direct, 26,006 indirect)

Ecosystem-wide dependent count for version 2.0.1.

DescriptionCVE.org

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

AnalysisAI

Arbitrary file read/write in the Node.js extract-zip library (max-mapper/extract-zip) arises because symlink entries inside zip archives are extracted without validating their targets. An attacker who supplies a crafted archive containing a symlink with a traversal target such as '../../../../etc/passwd' can cause files to be placed or resolved outside the intended extraction directory, leading to disclosure or modification of sensitive files depending on how the host application uses the extracted output. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, though the CVSS 4.0 base score of 8.6 reflects high confidentiality and integrity impact.

Technical ContextAI

extract-zip is a widely used Node.js/npm package that wraps yauzl to unpack zip archives to disk. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal), specifically the symlink-handling variant: a zip entry can carry a symbolic link whose target is an attacker-controlled relative path. Because extract-zip writes the symlink to disk without canonicalizing and confirming the resolved target stays within the extraction root, subsequent file operations that follow the symlink escape the intended directory. The affected component per CPE is cpe:2.3:a:max-mapper:extract-zip:*:*:*:*:*:*:*:* across all reported versions. Whether the impact is read, write, or both depends on whether the consuming application reads from or writes through the extracted symlink path.

RemediationAI

No vendor-released patched version was identified in the available data, so an exact fixed release cannot be cited; consult the GitHub Security Advisory GHSA-x7jf-2287-qcpf (https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf) and the CISA CSAF advisory (https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json) for an upgrade target and apply it once published. As compensating controls, avoid extracting untrusted archives with extract-zip on trusted hosts; if extraction is required, run it in a sandbox or container with no access to sensitive paths under a non-privileged user (trade-off: added orchestration complexity), and post-process by rejecting or stripping symlink entries and canonicalizing every resolved path to verify it stays within the extraction root before any read/write (trade-off: legitimate archives that rely on symlinks will break). Where feasible, switch to an extraction routine that refuses symlink entries entirely or validates targets, and disable following symlinks on the extraction directory at the filesystem level.

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-56876 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy