Max Mapper vulnerabilities
2 vulnerabilities
Known vulnerabilities in Max Mapper products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Extract Zip2 vulnerabilities
CVE-2026-19693chainguardfoxx-cli+65
EPSS score0.28%
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.CVE-2026-56876chainguardfoxx-cli+75EPSS score0.53%
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.