CVE-2026-56876 Details
Description
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.
A path traversal vulnerability has been identified in the extract-zip library, all versions. The issue arises because the library does not validate the targets of symbolic links when extracting zip files. This lack of validation allows malicious zip files containing symlinks with relative paths, such as '../../../../etc/passwd', to be extracted in a way that points outside the intended directory. As a result, an attacker could potentially read or write to arbitrary files on the system.
Users are advised to validate symlink targets manually before extraction, use alternative libraries like adm-zip or yauzl that provide proper path validation, or run extraction in a sandboxed environment, such as Docker.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 30, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | ExploitThird Party Advisory |
| https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | Third Party Advisory |
| https://www.cve.org/CVERecord?id=CVE-2026-56876 | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
Affected Products
| Product | Versions |
|---|---|
| max-mapper extract-zip | <= 2.0.1 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jun 30, 2026 | CVE Modified | CISA-ADP |
| Jun 26, 2026 | New CVE Received | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |