Arbitrary File Write Vulnerability in Extract-Zip by Max Mapper

CVE-2026-19693

What is CVE-2026-19693?

The Extract-Zip library, employed in various applications, presents a vulnerability wherein it only enforces containment checks on the parent directory of each archive entry. This design flaw results in potential exploitation through symlink attacks, where an archive can include two entries with identical names: a malicious symlink targeting a location outside of the designated directory, followed by a regular file. The vulnerability allows attackers to manipulate the extraction process, thereby enabling them to write files to unauthorized locations on the system.

References