CVE-2026-56876-POC

This is the orignal PoC for this CVE...

CVE-2026-56876 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce...

ROOT-APP-NPM-CVE-2026-56876 CVE-2026-56876 in extract-zip - Patched by Root

Root has patched CVE-2026-56876 in the extract-zip package for Root:npm. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-56876

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like...

0.app1 (1.0.52), 0.edsql (>=1.0.49, <=1.0.50) +29699 more potentially affected by CVE-2026-56876 via extract-zip (>=1.0.3, <=2.0.1)

extract-zip NPM version =1.0.3, =1.0.49, =1.0.49, =1.0.49, =1.0.51, =0.0.1, =0.8.0 - 10bis-shufersal-automation 1.0.0 - 123-movies 1.0.0 - 16promax-monitor 1.0.0 - 192.168.0.172 4.6.1 and more Source cves: CVE-2026-56876 Source advisory: SNYK:JS-EXTRACTZIP-17660777...

org.webjars.npm:karma-phantomjs-launcher (>=1.0.1, <=1.0.4), org.webjars.npm:phantomjs-prebuilt (2.1.16) +1 more potentially affected by CVE-2026-56876 via org.webjars.npm:extract-zip (>=1.7.0, <=2.0.1)

org.webjars.npm:extract-zip MAVEN version =1.7.0, =1.0.1, =3.3.0, =7.1.0 Source cves: CVE-2026-56876 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17660778...

CVE-2026-56876

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...