Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-17T13:30:22 extract-zip: extract-zip: Arbitrary file write via symlink in archive 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H CWE-59

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

A flaw was found in extract-zip. This vulnerability allows a remote attacker to perform an arbitrary file write outside the intended destination directory. By crafting a malicious zip archive containing a symbolic link (symlink) and a regular file with the same name, the attacker can bypass security checks. The extract-zip utility incorrectly validates only the parent directory, enabling the attacker to write files to arbitrary locations on the system.

Multicluster Engine for Kubernetes Not affected multicluster-engine/console-mce-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Affected workload-availability/node-healthcheck-rhel9-operator Node HealthCheck Operator Affected workload-availability/node-remediation-console-rhel8 OpenShift Pipelines Affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-operator-bundle OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/console-rhel9 Red Hat AMQ Broker 7 Not affected amq-broker-bin.zip Red Hat AMQ Broker 7 Not affected amq-broker-maven-repository.zip Red Hat Ansible Automation Platform 2 Not affected automation-platform-ui Red Hat Build of Podman Desktop Will not fix rh-podman-desktop.git Red Hat Ceph Storage 4 Affected rhceph/rhceph-4-dashboard-rhel8 Red Hat Enterprise Linux 10 Not affected grafana Red Hat Enterprise Linux 10 Not affected grafana-pcp Red Hat Enterprise Linux 10 Not affected rust Red Hat Enterprise Linux 8 Affected grafana Red Hat Enterprise Linux 8 Affected grafana-pcp Red Hat Enterprise Linux 8 Not affected rust-toolset:rhel8/rust Red Hat Enterprise Linux 9 Affected grafana Red Hat Enterprise Linux 9 Not affected grafana-pcp Red Hat Enterprise Linux 9 Not affected rust Red Hat Enterprise Linux AI (RHEL AI) 3 Affected rust Red Hat Fuse 7 Will not fix extract-zip Red Hat Hardened Images Not affected dotnet8.0 Red Hat Hardened Images Not affected grafana12.4 Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-agent-ops-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat OpenShift GitOps Affected microshift-gitops Red Hat OpenShift GitOps Not affected openshift-gitops-argocd-cli Red Hat Quay 3 Not affected quay/quay-rhel8 Red Hat Quay 3 Not affected quay/quay-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-19693 https://nvd.nist.gov/vuln/detail/CVE-2026-19693 https://github.com/max-mapper/extract-zip https://www.npmjs.com/package/extract-zip