{"id":"CVE-2026-19693","sourceIdentifier":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","published":"2026-08-17T14:20:20.737","lastModified":"2026-09-09T15:52:04.827","vulnStatus":"Deferred","cveTags":[{"sourceIdentifier":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","tags":["unsupported-when-assigned"]}],"descriptions":[{"lang":"en","value":"extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory."}],"affected":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","affectedData":[{"vendor":"max-mapper","product":"extract-zip","defaultStatus":"unaffected","collectionURL":"https://www.npmjs.com/package/extract-zip","packageName":"extract-zip","platforms":["Linux","macOS"],"repo":"https://github.com/max-mapper/extract-zip","packageURL":"pkg:npm/extract-zip","versions":[{"version":"1.0.0","lessThanOrEqual":"2.0.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-17T16:00:39.088818Z","id":"CVE-2026-19693","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-59"}]}],"references":[{"url":"https://github.com/max-mapper/extract-zip","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df"},{"url":"https://www.npmjs.com/package/extract-zip","source":"22e2d327-25fe-45d7-9f0c-dcd23b7108df"}]}