Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-26T16:44:29 extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CWE-22

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

A flaw was found in extract-zip. This vulnerability allows a remote attacker to craft a malicious zip file containing symbolic links that point to locations outside the intended extraction directory. When a user extracts this malicious archive, extract-zip fails to validate the symlink targets, leading to the creation of files in arbitrary locations on the system. This could enable an attacker to read or write to sensitive files, potentially leading to information disclosure or system compromise.

A flaw was found in the extract-zip npm package. The package does not validate symlink targets when extracting ZIP archives. When processing a malicious ZIP file containing a symlink with a relative path (e.g., '../../../../etc/passwd'), extract-zip extracts the symlink without validation, allowing it to point outside the intended extraction directory. Depending on how extract-zip is used, an attacker could read arbitrary files (information disclosure) or write to arbitrary locations (arbitrary file write) on the system. Exploitation requires a user or automated process to extract a crafted ZIP archive. No patch is available for extract-zip. The upstream maintainer is unresponsive (last commit 4+ years ago), and no fix is expected. Users should avoid using this package to extract untrusted ZIP archives. As a workaround, validate symlink targets manually before extraction, use an alternative library such as adm-zip or yauzl with proper path validation, or run extraction in a sandboxed environment (container, isolated filesystem). Cryostat 4 Not affected cryostat-openshift-console-plugin-npm Multicluster Engine for Kubernetes Not affected multicluster-engine/console-mce-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-must-gather-rhel9 Node HealthCheck Operator Affected workload-availability/node-healthcheck-operator-bundle Node HealthCheck Operator Affected workload-availability/node-healthcheck-rhel9-operator Node HealthCheck Operator Affected workload-availability/node-remediation-console-rhel8 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-pf5-rhel9 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel8 OpenShift Pipelines Not affected openshift-pipelines/pipelines-console-plugin-rhel9 OpenShift Service Mesh 2 Not affected openshift-service-mesh/kiali-ossmc-rhel8 OpenShift Service Mesh 2 Not affected openshift-service-mesh/kiali-rhel8 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-operator-bundle OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-ossmc-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/console-rhel9 Red Hat AMQ Broker 7 Not affected extract-zip Red Hat Build of Podman Desktop Not affected rh-podman-desktop.git Red Hat Enterprise Linux 10 Not affected rust Red Hat Enterprise Linux 8 Not affected grafana Red Hat Enterprise Linux 9 Not affected rust Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rust Red Hat Fuse 7 Not affected extract-zip Red Hat Hardened Images Not affected dotnet8.0 Red Hat Hardened Images Not affected rust Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-dashboard-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-automl-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-eval-hub-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-gen-ai-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mod-arch-model-registry-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-ui-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-console-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubevirt-console-plugin Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Quay 3 Not affected quay/quay-rhel8 Red Hat Quay 3 Not affected quay/quay-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-56876 https://nvd.nist.gov/vuln/detail/CVE-2026-56876 https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json