Directory Traversal Vulnerability in Zip-lib Affects Multiple Products

CVE-2026-17524

What is CVE-2026-17524?

Versions of the zip-lib package prior to 1.1.0 are exposed to a directory traversal vulnerability due to an inadequate caching mechanism employed during the path validation process while extracting files. This flaw allows attackers to bypass essential security checks meant to prevent unauthorized directory access, potentially leading to unauthorized file system access. The vulnerability arises from a failure in the isOutsideTargetFolder function, which only verifies and stores the path status during the creation of the initial directory symlink at the onset of extraction, leaving subsequent check vulnerabilities unaddressed.

References