CVE-2026-19693CWE-22CWE-59path-traversal

CVE-2026-19693

High · published August 17, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.4th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-08-17T18:20Z
References (2)
https://github.com/max-mapper/extract-zip · 22e2d327-25fe-45d7-9f0c-dcd23b7108dfhttps://www.npmjs.com/package/extract-zip · 22e2d327-25fe-45d7-9f0c-dcd23b7108df
EPSS history
Timeline
  • 17 AUG 13:30Z
    extract-zip arbitrary file write outside the destination directory via a symlink at the final path component
    cvelistv5