Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: max-mapper Clear all filters
TI-2026-15978 CVE-2026-19693 · GHSA-7pqw-9j4j-h8q3

extract-zip arbitrary file write outside the destination directory via a symlink at the final path component

Priority LOW 36

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose tar…

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00453 Published 2026-08-17 Partial fix CWE-22
TI-2026-41002 CVE-2026-56876 · GHSA-jmr9-qjv8-65gv

extract-zip unvalidated symlink path traversal

Priority HIGH 72

extract-zip does not validate symlink targets when extracting zip archives.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00526 Published 2026-06-26 Partial fix CWE-22