{"id":"EUVD-2026-39812","enisaUuid":"9188df5f-d105-3d5c-8fcf-5314ee855bc1","description":"extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like \u0027../../../../etc/passwd\u0027, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.","datePublished":"Jun 26, 2026, 4:44:29 PM","dateUpdated":"Jun 30, 2026, 7:59:09 PM","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf\nhttps://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json\nhttps://www.cve.org/CVERecord?id\u003dCVE-2026-56876\n","aliases":"CVE-2026-56876\nGHSA-jmr9-qjv8-65gv\n","assigner":"cisa-cg","epss":0.53,"enisaIdProduct":[{"id":"cef6b1af-6cf4-34ad-b79a-ded699790950","product":{"name":"extract-zip","vendor":{"name":"max-mapper"}},"product_version":"0 \u003c*"}],"enisaIdVendor":[{"id":"e7e2963a-1de1-3ab6-ac21-0a53f0d67c99","vendor":{"name":"max-mapper"}}],"enisaIdVulnerability":[{"id":"a178a791-2651-3a11-b582-c9f899ce3305","vulnerability":{"id":"CVE-2026-56876","description":"extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like \u0027../../../../etc/passwd\u0027, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.","datePublished":"Jun 26, 2026, 4:44:29 PM","dateUpdated":"Jun 30, 2026, 7:59:09 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf\nhttps://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json\nhttps://www.cve.org/CVERecord?id\u003dCVE-2026-56876\n","enisa_id":"EUVD-2026-39812\n","assigner":"cisa-cg","epss":0.53,"dataProcessed":"Nov 7, 2026, 7:21:17 AM","vulnerabilityProduct":[{"id":"92aaff54-1bc5-3a09-b75b-10a05857a2d2","product":{"name":"extract-zip","vendor":{"name":"max-mapper"}},"product_version":"0 \u003c*"}],"vulnerabilityVendor":[{"id":"04520b5c-6510-361d-a421-c01af2538882","vendor":{"name":"max-mapper"}}]}},{"id":"c15d76fc-7076-39f9-87ab-130b126e75ae","vulnerability":{"id":"GHSA-jmr9-qjv8-65gv","description":"extract-zip unvalidated symlink path traversal","datePublished":"Jun 26, 2026, 6:34:00 PM","dateUpdated":"Aug 12, 2026, 7:22:03 PM","baseScore":0.0,"references":"https://github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-56876\nhttps://github.com/max-mapper/extract-zip\nhttps://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json\nhttps://www.cve.org/CVERecord?id\u003dCVE-2026-56876\n","enisa_id":"EUVD-2026-39812\n","aliases":"GHSA-jmr9-qjv8-65gv\nCVE-2026-56876\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"41515481-40a7-3f10-af70-93a32b19863a","advisory":{"id":"RHSA-2026:57590","description":"Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update","summary":"An update for rh-podman-desktop is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.","datePublished":"Aug 20, 2026, 4:08:12 PM","dateUpdated":"Oct 31, 2026, 3:40:37 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:57590\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57590.json\n","aliases":"CVE-2026-9595\nCVE-2026-12143\nCVE-2026-13149\nCVE-2026-13676\nCVE-2026-14257\nCVE-2026-34986\nCVE-2026-42338\nCVE-2026-42570\nCVE-2026-44705\nCVE-2026-45623\nCVE-2026-45736\nCVE-2026-45740\nCVE-2026-48068\nCVE-2026-48779\nCVE-2026-48801\nCVE-2026-49978\nCVE-2026-56876\nCVE-2026-59869\nCVE-2026-59873\nCVE-2026-59874\nCVE-2026-59877\nCVE-2026-69152\nCVE-2026-69153\nCVE-2026-69192\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"a0e097d4-0a2d-365f-b976-bf35c1dc36c7","product":{"name":"rh-podman-desktop-0:1.1.2-1.el10_2.src","vendor":{"name":"Red Hat"}}},{"id":"a512bf43-d316-3301-92e4-9fbed5576724","product":{"name":"Red Hat Enterprise Linux Extensions Channel (v. 10)","vendor":{"name":"Red Hat"}}},{"id":"cff26611-f0bb-38c1-ad86-bd0c1db47355","product":{"name":"rh-podman-desktop-0:1.1.2-1.el10_2.x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"4c6cef86-8796-3ce7-97e0-7bed190ad78e","advisory":{"id":"VA-26-177-01","description":"extract-zip unvalidated symlink path traversal","summary":"extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like \u0027../../../../etc/passwd\u0027, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.","datePublished":"Jun 26, 2026, 4:08:29 PM","dateUpdated":"Jun 26, 2026, 4:08:29 PM","baseScore":0.0,"references":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json\n","aliases":"CVE-2026-56876\n","source":{"id":6,"name":"csaf_cisa"},"advisoryProduct":[{"id":"20d40f24-dcc9-3548-b8f0-d97c817af26d","product":{"name":"extract-zip","vendor":{"name":"max-mapper"}}}]}},{"id":"956b1465-bbe0-3062-81ce-a2af8f40164b","advisory":{"id":"openSUSE-SU-2026:11200-1","description":"heroic-games-launcher-2.22.0-4.1 on GA media","summary":"heroic-games-launcher-2.22.0-4.1 on GA media","datePublished":"Jul 7, 2026, 12:00:00 AM","dateUpdated":"Sep 17, 2026, 5:13:14 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11200-1.json\nhttps://www.suse.com/security/cve/CVE-2026-54672/\nhttps://www.suse.com/security/cve/CVE-2026-54673/\nhttps://www.suse.com/security/cve/CVE-2026-56876/\n","aliases":"CVE-2026-54672\nCVE-2026-54673\nCVE-2026-56876\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1452b6da-4771-3e7a-80bf-e437bb95d2f3","product":{"name":"heroic-games-launcher-0:2.22.0-4.1.s390x","vendor":{"name":"SUSE"}}},{"id":"368d5211-dec6-3173-b2f4-babca3062805","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"9e33ca81-c37c-3c11-ae8c-a3a656b29644","product":{"name":"heroic-games-launcher-0:2.22.0-4.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"a3ed9b0b-4d37-306e-b916-7c2dc222fe31","product":{"name":"heroic-games-launcher-0:2.22.0-4.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f4cf52bf-17f4-3bb1-89a6-2d789cbd24fc","product":{"name":"heroic-games-launcher-0:2.22.0-4.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}