Executive brief
The extract-zip library, a popular tool for unzipping files in Node.js applications, fails to verify where symbolic links point when extracting an archive. An attacker can provide a specially crafted ZIP file that, when opened, creates links to sensitive system files outside of the intended folder. This could allow an attacker to read private data like passwords or overwrite critical system files, potentially leading to a full system takeover.
Technical details
The extract-zip package is vulnerable to a path traversal flaw (CWE-22/CWE-59) because it does not validate the targets of symbolic links contained within ZIP archives. When an archive containing a symlink with a relative path (e.g., '../../../../etc/passwd') is processed, the library creates the link as specified without ensuring it remains within the destination directory. If the application later interacts with these extracted files, an attacker can achieve arbitrary file read or write. This is particularly dangerous in backend environments processing user-uploaded archives. As of June 2026, no patch is available as the maintainer is unresponsive; users are advised to migrate to alternative libraries like adm-zip or yauzl.
Affected products
- max-mapper extract-zip All versions
Timeline
- 2026-06-15: advisory: Initial security advisory published by researcher
- 2026-06-26: disclosed: CVE-2026-56876 published