CVE-2026-56876: max-mapper extract-zip Path Traversal
CVSS: 8.6v4.0HighAnalyzed
AliasesUBUNTU-CVE-2026-56876DEBIAN-CVE-2026-56876GHSA-jmr9-qjv8-65gvCGA-24pg-ph6g-8ch9CGA-256x-f2fm-4w2vCGA-26h3-2qcp-6x23CGA-2fh2-28w4-rx85CGA-2mwx-5985-m44vCGA-2v9x-g63g-7f4fCGA-2vw2-2g55-j82fCGA-2vwh-c27p-crmwCGA-2w7x-h9vh-qg44CGA-2x35-874p-2fccCGA-332g-wjvp-v8rfCGA-339q-5563-c2w5CGA-35cc-c47r-mgg6CGA-3jph-3pvj-jj7jCGA-3q7m-g28f-7hr6CGA-3qg9-jf2p-w75gCGA-4h88-64c6-w28xCGA-4q3p-qjfx-87wpCGA-53qj-8fcr-qxprCGA-57gc-r477-3fw7CGA-5c6g-j43j-p5cgCGA-5cpv-65c6-5fc7CGA-5f54-6hqw-hmj6CGA-5j8m-5wvp-f56mCGA-5jj2-mrmr-xwm8CGA-5pmr-vjcj-836mCGA-5q8p-jrcp-979jCGA-5x55-mmh6-7j4jCGA-62wv-866f-8q9wCGA-66w3-72c9-hxhpCGA-6c7w-hg76-8jm5CGA-6ccv-4pvg-3g4rCGA-6cm9-rh6f-h874CGA-6q86-mvcj-24j6CGA-6rpp-qwp9-8c48CGA-73ch-gfpq-j9g7CGA-7587-6cv2-m7mfCGA-77wr-7gh3-4h53CGA-7ffx-9f45-jp99CGA-7fmv-72g7-55rhCGA-7p62-gxp4-cf72CGA-7qc4-6gc9-mrr3CGA-7rq2-xc33-jrggCGA-7wr8-cxwh-8j44CGA-836p-8g9x-v3m7CGA-83xv-65fc-f35cCGA-8663-wwq4-rqccCGA-877j-fpp8-hrh5CGA-8887-v2wf-rc89CGA-8gc8-wqgr-fhmqCGA-8hcf-jq9g-p25pCGA-94j7-rff4-pv6hCGA-97f8-7g84-qc8cCGA-9jpc-64rh-wh2gCGA-9qfq-h78p-jjpjCGA-c8q3-m7cc-xq92CGA-cmp9-ggwv-29j4CGA-cpfp-f2wf-526fCGA-crmf-3hfh-jr69CGA-cw89-45q8-gwx9CGA-f3vr-pvm8-q7jcCGA-f524-7xwc-xfvqCGA-f76f-c7f2-2mcgCGA-f7hj-hrcj-4x84CGA-f7p4-rgr8-hx9xCGA-fcmq-9q6p-3cpfCGA-fcwh-r2jc-6c3wCGA-ffhm-jjhh-w92xCGA-ffp6-xxxc-fw8vCGA-fm8c-9w2g-4j55CGA-g43q-7c29-q3f4CGA-g572-r229-25v8CGA-gh2g-jf9m-xjfwCGA-ghp6-6f65-wvv8CGA-gmxw-m82j-cc28CGA-gv5x-qx4f-c3rfCGA-gvr3-p3fw-7vv9CGA-h2xh-7wh7-xw82CGA-h487-g32q-8xwcCGA-h8fp-4x43-47hjCGA-h94h-97wm-hcgcCGA-hcf8-vq6p-r788CGA-hrrg-5w7p-jpqfCGA-hwj6-7xc5-x5cpCGA-j4vr-v6vj-p2fjCGA-jcm7-qjjp-fggfCGA-jcxh-4xwj-vcv6CGA-jcxr-vrjm-6q92CGA-jf44-89h8-6488CGA-jhgg-8gc7-qqxpCGA-jj28-939w-h886CGA-jpg4-3pgc-hppjCGA-jpv4-6fhx-g729CGA-m8ff-vcj2-3hxfCGA-mc4h-568q-hgwvCGA-mj6v-5hg5-f4wwCGA-mqx4-7pf7-4hxjCGA-p643-xg65-xmm4CGA-p79v-2j58-6fpfCGA-p8cx-97j3-wpq4CGA-pc9m-gr4g-pv9fCGA-pg63-9q37-jfm3CGA-pvr8-7rmf-564qCGA-q27m-xx8q-qh84CGA-q295-w396-3c2pCGA-q5fw-mjjx-gmxrCGA-q6xp-qfx8-mvccCGA-q8hp-p83x-wqwwCGA-q8r7-cmqj-j5vxCGA-qm72-q3w5-v8fpCGA-qw5c-hwp8-j937CGA-qxwv-vm97-536xCGA-r2fq-76xc-333fCGA-r3p8-qm5x-rx3jCGA-r53j-mx53-ggv6CGA-r5cp-h869-8vvqCGA-r5mj-wwrm-cvjvCGA-r5rr-g4x7-jwhmCGA-rf33-x36r-73mqCGA-rfg5-j9j6-74wfCGA-rjw2-32px-f8fwCGA-rvv4-p4g6-q2gvCGA-v3j7-h4cm-4wmjCGA-v83q-fx3x-v7f5CGA-vcgf-ff76-6ffvCGA-vcx8-x524-px4hCGA-vgmq-wc3f-65qhCGA-vjjh-q2gj-h5x7CGA-vqmh-3qr2-45vcCGA-vv22-7qff-mcfgCGA-vv8p-mv4w-c9p2CGA-w3rr-pxrh-2w55CGA-w788-f6jr-4vcqCGA-w7jj-r4v2-hp7mCGA-wfm3-8hwc-4mggCGA-wj7m-rh8p-j623CGA-wm65-23jv-p9rcCGA-wp92-89g3-28w2CGA-wrhw-xq8x-mc52CGA-x2xj-6wcm-jvchCGA-x3jr-cvfh-8gq9CGA-xf88-9843-x6hrCGA-xhjc-3mxh-4v2pCGA-xjrr-8vpf-9hxvCGA-xr2m-j3rm-mr7pCGA-xwmv-cvwx-w4jh
Published 26-06-2026Last modified 30-06-2026
Vulnerability summary
CVE-2026-56876 is a high (CVSS 8.6) Path Traversal vulnerability in max-mapper extract-zip. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.6/10
010
High · v4.0 (CVE.org)EPSS score
0.53%
0%100%
Low · +0.13 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 26-06-2026PublishedVulnerability first disclosed.
- 30-06-2026Last modifiedVulnerability information updated.
Description
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.
CVSS metrics
11 scores · 6 sources · 2 versionsHigh 8.6Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated8.6HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.6HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · NpmEcosystem advisory · calculated8.6HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.6HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.6HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 8.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · NpmEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.13 pp
From 0.39% on 21-09-2026
21-09-202621-10-2026
EPSS score0.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExtract Zip Security Research
Maturity: poc
Weaknesses
CWE · root cause- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-61UNIX Symbolic Link (Symlink) FollowingThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Affected systems
Chainguard72 products
- foxx-cliAll versions (No fix recorded)
- gemini-cliAll versions (No fix recorded)
- gitlab-rails-ce-18.1All versions (No fix recorded)
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11All versions (No fix recorded)
Debian1 product
- node-extract-zipAll versions (No fix recorded)
Max-mapper1 product
- extract-zipAll versions (No fix recorded) | ≤ 2.0.1
Npm1 product
- extract-zip≤ 2.0.1
Ubuntu1 product
- node-extract-zipAll versions (No fix recorded)
5 vendors · 76 products
References
7 links- github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpfThird Party AdvisoryREPORTWEBExploit
- raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.jsonThird Party AdvisoryREPORTWEB
