CVE-2026-107709 Details

A path traversal vulnerability has been identified in Bower's decompress-zip library, affecting versions through 0.3.3. The issue arises in the file decompress-zip.js, where the library fails to properly validate archive entry paths during the extraction of ZIP files. This flaw allows a crafted ZIP archive to be exploited, causing files to be written outside the intended extraction directory by taking advantage of prefix-sibling directory paths. Successful exploitation could lead to arbitrary file overwrites, application compromises, or remote code execution, depending on the target environment and the availability of writable sibling paths.

No fixed version is available, as the library is abandoned. Users are advised to replace the library with a maintained alternative that enforces proper path validation, such as 'yauzl' with explicit entry-path validation. If an immediate replacement is not possible, validate ZIP entry paths against the destination before extraction, extract to an isolated directory and move only expected files, or pin the dependency in software composition analysis tools to prevent its use in new projects.