extract-zip unvalidated symlink path traversal
Priority HIGH 72CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00526 44th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| max-mapper | extract-zip | all versions | — | No fix listed | CNA |
| — | extract-zip (npm) | up to 2.0.1 | — | No fix listed | GHSA-jmr9-qjv8-65gv |
- extract-zip Vendormax-mapper Affected all versions Fixed in — No fix listed CNA
- extract-zip (npm) Vendor— Affected up to 2.0.1 Fixed in — No fix listed GHSA-jmr9-qjv8-65gv
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:max-mapper:extract-zip:*:*:*:*:*:node.js:*:* | up to 2.0.1 | Vulnerable | max-mapper |
- cpe:2.3:a:max-mapper:extract-zip:*:*:*:*:*:node.js:*:* Versions up to 2.0.1 Vulnerable ·max-mapper
Remediation
Red Hat 1 advisory
- RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Importantrh-podman-desktop security, bug fix, and enhancement update
- Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Node HealthCheck Operator | Affected | No fix yet |
| Red Hat OpenShift Container Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux Extensions Channel (v. 10) | Fixed | RHSA-2026:57590 |
Not affected: 19 products
- Cryostat 4
- Multicluster Engine for Kubernetes
- OpenShift Pipelines
- OpenShift Service Mesh 2
- OpenShift Service Mesh 3
- Red Hat AMQ Broker 7
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Build of Podman Desktop
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Fuse 7
- Red Hat Hardened Images
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift Virtualization 4
- Red Hat Quay 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-56876
- 2026-10-03 Alias added: GHSA-jmr9-qjv8-65gv
- 2026-10-30 Affected versions changed · Red Hat
References
Exploit 1
Sources
- CVE-2026-56876 · CVE Program
- CVE-2026-56876 · NVD
- FIRST EPSS
- GHSA-jmr9-qjv8-65gv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-56876 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences