Directory Traversal

Overview decompress-zip is an extracts the contents of the ZIP archive file. Affected versions of this package are vulnerable to Directory Traversal via the extract function in lib/decompress-zip.js, which does not validate that extracted file paths remain within the target directory. An attacker...

2app (>=1.2.7, <=1.2.8), @01/service-core (>=2.0.1, <=2.1.4) +1599 more potentially affected by CVE-2026-107709 via decompress-zip (>=0.0.2, <=0.3.3)

decompress-zip NPM version =0.0.2, =1.2.7, =2.0.1, =0.0.3, =1.0.7, =0.0.0, =2.0.0, =0.6.0, =1.0.6, =1.0.0, =3.0.0-alpha.0, =3.0.0-next.36, =3.8.4, =4.0.17 and more Source cves: CVE-2026-107709 Source advisory: SNYK:JS-DECOMPRESSZIP-20883330...

Directory Traversal

Overview org.webjars.npm:decompress-zip is an extracts the contents of the ZIP archive file. Affected versions of this package are vulnerable to Directory Traversal via the extract function in lib/decompress-zip.js, which does not validate that extracted file paths remain within the target...

CVE-2026-107709

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709 Bower decompress-zip has a path traversal vulnerability

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

EUVD-2026-95103

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709 Bower decompress-zip has a path traversal vulnerability

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3 . The issue is located in lib/decompress-zip.js, where the software improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive with entries resolving to prefix-sibling directories can ca...

CVE-2026-107709 Bower decompress-zip has a path traversal vulnerability

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in "lib/decompress-zip.js" improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause...

PT-2026-108062

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CVE-2026-107709: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in lib/decompress-zip.js improperly validates archive entry paths during ZIP extraction. A crafted ZIP archive containing entries that resolve to prefix-sibling directories can cause fil...

CLSA-2026-1774225215 TuxCare security update for decompress-zip (1 CVE)

TuxCare rebuilt decompress-zip to address 1 CVE. Fixed in 0.1.0-tuxcare.1...

PT-2026-74087

TuxCare rebuilt decompress-zip to address 1 CVE. Fixed in 0.1.0-tuxcare.1...

WS-2019-0164

decompress-zip 0.2.x before 0.2.2 and 0.3.x before 0.3.2 has a Zip-Slip vulnerability, an arbitrary file write vulnerability...

@achingbrain/ngrok (0.2.2), @atomist/sdm-automation (>=0.1.16-master.20181116180810, <=0.1.59-master.20200611224542) +601 more potentially affected by unknown CVE via decompress-zip (>=0.0.2, <=0.2.0)

decompress-zip NPM version =0.0.2, =0.1.16-master.20181116180810, =14.0.5, =0.1.2, =1.2.6, =1.0.1, =1.0.0, =1.1.1, =5.0.1, =1.0.0, =5.2.1, =5.3.0 - @paulcbetts/squirrel-windows 1.2.1 - @pgswe/ics.js 0.1.3 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0164...

@angular/benchpress (0.1.0), @camptocamp/closure-util (>=1.20.0, <=1.27.0) +140 more potentially affected by unknown CVE via decompress-zip (>=0.3.0, <=0.3.1)

decompress-zip NPM version =0.3.0, =1.20.0, =0.4.0, =0.4.0, =0.5.0-beta.2, =1.36.0, =0.0.1, =3.6.0, =1.0.0, =0.1.0, =0.1.3 and more Source cves: unknown CVE Source advisory: MEND:WS-2019-0164...

OpenImageIO PSDInput::decompress_zip_prediction() Heap Buffer Overflow DoS

The vulnerability of the PSDInput::decompresszipprediction function in the src/psd.imageio/psdinput.cpp module of the OpenImageIO library is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the integrity of protected information or cause service...

PT-2025-54939

Уязвимость функции PSDInput::decompress zip prediction в модуле src/psd.imageio/psdinput.cpp библиотеки OpenImageIO связана с целочисленным переполнением. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность защищаемой информации или вызват...

@achingbrain/ngrok (0.2.2), @atomist/sdm-automation (>=0.1.16-master.20181116180810, <=0.1.59-master.20200611224542) +601 more potentially affected by unknown CVE via decompress-zip (>=0.0.2, <=0.2.0)

decompress-zip NPM version =0.0.2, =0.1.16-master.20181116180810, =14.0.5, =0.1.2, =1.2.6, =1.0.1, =1.0.0, =1.1.1, =5.0.1, =1.0.0, =5.2.1, =5.3.0 - @paulcbetts/squirrel-windows 1.2.1 - @pgswe/ics.js 0.1.3 and more Source cves: unknown CVE Source advisory: OSV:GHSA-73V8-V6G4-VRPM...