Symlink Validation Vulnerability in extract-zip Affects Various Applications

CVE-2026-56876

What is CVE-2026-56876?

The extract-zip library is susceptible to a security flaw where it fails to validate symlink targets during the extraction of zip archives. This absence of validation allows attackers to craft malicious zip files containing symlinks with relative paths like '../../../../etc/passwd'. When these zip files are processed, the extract-zip tool extracts the symlinks without checking their validity, potentially enabling unauthorized access to read or write sensitive files outside the intended extraction directory. This vulnerability highlights the importance of implementing strict validation checks to safeguard against unauthorized file access during the extraction process.

References