CVE-2026-17524CWE-22path-traversal

CVE-2026-17524

High · published July 28, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
66.7
In the wild
Unconfirmed
What it is

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01152 · 66.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-28T10:16Z
References (3)
https://github.com/fpsqdb/zip-lib/commit/0c29b1e17050f2611f4f37e6aaa92a60b3cb89d5 · [email protected]https://github.com/fpsqdb/zip-lib/issues/14 · [email protected]https://security.snyk.io/vuln/SNYK-JS-ZIPLIB-13834403 · [email protected]
EPSS history
Timeline
  • 28 JUL 05:00Z
    Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process
    cvelistv5