EUVD-2026-39812Published

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validatio…

Exact source revision recorded 28 Oct 2026 08:16:45 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

euvd · EUVD-2026-39812

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jun 26, 2026, 4:44:29 PM

dateUpdated: Jun 30, 2026, 7:59:09 PM

3 related source bulletins · separate from aliases

RHSA-2026:57590: Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update

CVE-2026-9595 · CVE-2026-12143 · CVE-2026-13149 · CVE-2026-13676 · CVE-2026-14257 · CVE-2026-34986 · CVE-2026-42338 · CVE-2026-42570 · CVE-2026-44705 · CVE-2026-45623 · CVE-2026-45736 · CVE-2026-45740 · CVE-2026-48068 · CVE-2026-48779 · CVE-2026-48801 · CVE-2026-49978 · CVE-2026-56876 · CVE-2026-59869 · CVE-2026-59873 · CVE-2026-59874 · CVE-2026-59877 · CVE-2026-69152 · CVE-2026-69153 · CVE-2026-69192

VA-26-177-01: extract-zip unvalidated symlink path traversal

CVE-2026-56876

openSUSE-SU-2026:11200-1: heroic-games-launcher-2.22.0-4.1 on GA media

CVE-2026-54672 · CVE-2026-54673 · CVE-2026-56876

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON