Loading vulnerability…
Symlink Path Traversal in extract-zip
CVE-2026-56876 is a symlink validation vulnerability in extract-zip through version 2.0.1. During ZIP extraction, the package creates symbolic links without validating whether their targets remain within the intended extraction directory. A crafted archive can therefore create links with relative traversal targets that reference files outside that directory. Depending on how the consuming application subsequently accesses extracted entries, this can enable arbitrary file reads or writes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality and integrity of files outside the intended extraction directory. Applications that follow attacker-controlled extracted symlinks may disclose sensitive files or modify unrelated files accessible to the process. The resulting impact depends on application behavior and filesystem permissions; creation of an escaping symlink alone does not establish that an arbitrary read or write occurs.
If you can’t patch tonight, do this now.
Avoid extracting archives from untrusted sources. Inspect and sanitize archive contents before extraction, rejecting symbolic-link entries or validating that their resolved targets remain within the extraction directory. Prevent downstream processing from following links that escape that directory.
Patch, then assume compromise.
Remove or replace the vulnerable extract-zip dependency, or adopt an upstream fixed release when one becomes available. All versions through 2.0.1 are identified as affected, and no specific upstream fixed release is established. For affected bundled products, apply the relevant vendor update: MongoDB Ops Manager Server 8.0.27 removes extract-zip through migration to Cypress 16; Red Hat provides rh-podman-desktop 1.1.2 for RHEL 10.2 Extensions; and HCL identifies BigFix AEX 14.0 as remediating the issue.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.