CLSA-2026-1792696135 TuxCare security update for extract-zip (2 CVEs)

TuxCare rebuilt extract-zip to address 2 CVEs. Fixed in 1.7.0-tuxcare.2...

Atlassian Confluence < 9.2.5 (CONFSERVER-104458)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104458 advisory. - extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so a...

Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip through 2.0.1 only checks the parent directory of each archive entry, allowing a symlink-then-regular-file pair with identical names to write through the planted symlink and achieve arbitrary file write outside the destination directory. CVSS: 8.1 High, CWE-22. Vulnerability...

Security Bulletin: extract-zip-2.0.1.tgz (Publicly disclosed vulnerability found by Scanner)

Summary extract-zip 2.0.1 does not validate symlink targets during zip extraction, allowing a malicious archive with relative symlink paths to read or write arbitrary files outside the extraction directory. CVSS: 8.1 High, CWE-22. Vulnerability Details CVEID:CVE-2026-56876 DESCRIPTION: extract-zi...

ROOT-APP-NPM-CVE-2026-19693 CVE-2026-19693 in extract-zip - Patched by Root

Root has patched CVE-2026-19693 in the extract-zip package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-56876 CVE-2026-56876 in extract-zip - Patched by Root

Root has patched CVE-2026-56876 in the extract-zip package for Root:npm. Multiple fixed versions available...

File Inclusion extract-zip Dependency in Confluence Data Center

This High severity File Inclusion vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.3, and 9.4.0 of Confluence Data Center. This File Inclusion vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H allows an unauthenticated attacker to...

CVE-2026-19693

A flaw was found in extract-zip. This vulnerability allows a remote attacker to perform an arbitrary file write outside the intended destination directory. By crafting a malicious zip archive containing a symbolic link symlink and a regular file with the same name, the attacker can bypass securit...

extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass

A flaw was found in extract-zip. This vulnerability allows a remote attacker to craft a malicious zip file containing symbolic links that point to locations outside the intended extraction directory. When a user extracts this malicious archive, extract-zip fails to validate the symlink targets,...

SUSE CVE-2026-19693

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

Linux Distros Unpatched Vulnerability : CVE-2026-19693

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive...

GHSA-7PQW-9J4J-H8Q3 extract-zip allows arbitrary file writes through symlink archive entries

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

Directory Traversal

Overview extract-zip is an unzip a zip file into a directory using 100% javascript Affected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in index.js. An attacker can write a file outside the destination directory by supplying an archive with...

0.extends.wechat (>=1.0.51, <=1.0.65), 007putra-my-bot (1.1.1) +17809 more potentially affected by CVE-2026-19693 via extract-zip (>=2.0.0, <=2.0.1)

extract-zip NPM version =2.0.0, =1.0.51, =0.0.1, =1.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-19693 Source advisory: GHSA-7PQW-9J4J-H8Q3...

extract-zip allows arbitrary file writes through symlink archive entries

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

0.app1 (1.0.52), 0.edsql (>=1.0.49, <=1.0.50) +29900 more potentially affected by CVE-2026-19693 via extract-zip (>=1.0.3, <=2.0.1)

extract-zip NPM version =1.0.3, =1.0.49, =1.0.49, =1.0.49, =1.0.51, =0.0.1, =0.8.0 - 10bis-shufersal-automation 1.0.0 - 123-movies 1.0.0 - 16promax-monitor 1.0.0 - 192.168.0.172 4.6.1 and more Source cves: CVE-2026-19693 Source advisory: SNYK:JS-EXTRACTZIP-19653641...

0.extends.wechat (>=1.0.51, <=1.0.65), 007putra-my-bot (1.1.1) +17809 more potentially affected by CVE-2026-19693 via extract-zip (>=2.0.0, <=2.0.1)

extract-zip NPM version =2.0.0, =1.0.51, =0.0.1, =1.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-19693 Source advisory: OSV:GHSA-7PQW-9J4J-H8Q3...

DEBIAN-CVE-2026-19693

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

CVE-2026-19693

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

CVE-2026-19693

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...