CVE-2026-19693: extract-zip arbitrary file write outside the destination directory via a symlink at the final path component
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19693?
CVE-2026-19693 has a severity rating of 8.1, indicating a high risk.
How do I fix CVE-2026-19693?
To fix CVE-2026-19693, it is recommended to update the extract-zip library to version 2.0.2 or later.
What types of attacks can occur due to CVE-2026-19693?
CVE-2026-19693 can allow arbitrary file writes outside the intended directory, leading to potential unauthorized file access or modification.
Is my system vulnerable to CVE-2026-19693?
If you are using extract-zip version 2.0.1 or earlier, your system is vulnerable to CVE-2026-19693.
What is the main cause of CVE-2026-19693?
The main cause of CVE-2026-19693 is the inadequate containment-check that only verifies the parent directory of archive entries, ignoring the final path component.