CVE-2026-19693

8.1 Élevée

Publiée le 17/08/2026 à 16:20 · Modifiée le 09/09/2026 à 17:52 · Analyse NVD reportée · Source : 22e2d327-25fe-45d7-9f0c-dcd23b7108df

Description

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

Traduire en français

Produits concernés

max-mapper extract-zip

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	22e2d327-25fe-45d7-9f0c-dcd23b7108df	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-22
CWE-59

Références

https://github.com/max-mapper/extract-zip
https://www.npmjs.com/package/extract-zip

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories