CVE-2026-56876

creationtimestamp| type| source ---|---|--- 2026-06-26 18:31:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7lc624i52z 2026-06-27 09:00:53+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mpb3v7jhqg2i...

DEBIAN-CVE-2026-56876

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...