TI-2026-41002 CVE-2026-56876 · GHSA-jmr9-qjv8-65gv
extract-zip unvalidated symlink path traversal
Priority HIGH 72
extract-zip does not validate symlink targets when extracting zip archives.
max-mapper
Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
max-mapper records in CISA KEVNo max-mapper vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
2 records
TI-2026-15978 CVE-2026-19693 · GHSA-7pqw-9j4j-h8q3
extract-zip arbitrary file write outside the destination directory via a symlink at the final path component
Priority LOW 36
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose tar…