extract-zip arbitrary file write outside the destination directory via a symlink at the final path component
Priority LOW 36CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 1 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00453 39th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| max-mapper | extract-zip | 1.0.0 – 2.0.1 | — | No fix listed | CNA |
| — | extract-zip (npm) | up to 2.0.1 | — | No fix listed | GHSA-7pqw-9j4j-h8q3 |
- extract-zip Vendormax-mapper Affected 1.0.0 – 2.0.1 Fixed in — No fix listed CNA
- extract-zip (npm) Vendor— Affected up to 2.0.1 Fixed in — No fix listed GHSA-7pqw-9j4j-h8q3
Remediation
Red Hat 1 advisory
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix yet |
| Red Hat Build of Podman Desktop | Affected | No fix planned: Will not fix |
| Red Hat Ceph Storage 4 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
Not affected: 14 products
- Multicluster Engine for Kubernetes
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Hardened Images
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift GitOps
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-19693
- 2026-10-03 Alias added: GHSA-7pqw-9j4j-h8q3
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
References
More max-mapper vulnerabilities
- TI-2026-41002 extract-zip unvalidated symlink path traversal CVSS 4.0HIGH 8.6
Sources
- CVE-2026-19693 · CVE Program
- CVE-2026-19693 · NVD
- FIRST EPSS
- GHSA-7pqw-9j4j-h8q3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-19693 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences