extract-zip CVE-2026-56876

Exploitation requires that the target application use extract-zip to unpack an attacker-supplied zip archive containing a symbolic-link entry with a relative traversal target (the description explicitly names a symlink path like '../../../../etc/passwd'); no authentication or special privileges are needed (PR:N), but passive interaction is required (UI:P) in that a victim system must actually ingest and extract the malicious archive. Whether the outcome is arbitrary read, arbitrary write, or both is limited by how the consuming application subsequently uses the extracted files (reading from versus writing through the symlink). Limiting factors: the bug is not triggered by merely receiving the archive - extraction must occur, the host filesystem must honor symlinks (Unix-like systems; behavior differs on platforms/configs that ignore or block symlink creation), and the process must have permissions to the targeted out-of-tree paths.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N) indicates a network-reachable, low-complexity flaw requiring no privileges but passive operator interaction (the victim application must process the malicious archive), with high confidentiality and integrity impact and no availability impact - consistent with the 8.6 score. No EPSS score was supplied and the CVE is not in CISA KEV, so there is no signal of active exploitation; this is high-severity-by-impact rather than a confirmed in-the-wild threat. The UI:P requirement is the main mitigating factor: exploitation depends on a target ingesting an attacker-supplied zip, which is common in upload/import/CI pipelines but not automatic. No SSVC data was provided; given a popular library and a well-understood, easily weaponizable bug class, automatability of exploit development is plausible even though no public PoC is confirmed here.

An attacker crafts a zip archive containing a symlink entry whose target is a relative traversal path (e.g. '../../../../etc/passwd' or a path into the application's config/credential directory) and delivers it to a service that uses extract-zip to unpack uploads. When the application extracts the archive and later reads from or writes through the planted symlink, the attacker reads sensitive files outside the extraction directory or overwrites files such as configuration or startup scripts. No public exploit code is confirmed, but the low attack complexity and well-known technique make a working exploit straightforward to develop.