CVE-2026-19693 | BDVDB-2026-360444 Detail

Description#

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-08-17Record published in the CVE List.
2. Version 22026-08-27Most recent update recorded in the CVE List.