CVE-2026-56876

ADVISORY - github

Summary

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

EPSS Score⁠: 0.00391 (0.321)

Common Weakness Enumeration (CWE)

ADVISORY - github

CWE-22⁠

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Impacted images

Advisories

GitHub

CREATED

2 months ago

UPDATED

2 days ago

ADVISORY IDGHSA-jmr9-qjv8-65gv⁠

EXPLOITABILITY SCORE

2.8

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)

CWE-22⁠

CVSS SCORE

8.6high

Debian

CREATED

2 months ago

UPDATED

19 days ago

ADVISORY IDCVE-2026-56876⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

Ubuntu

CREATED

2 months ago

UPDATED

2 months ago

ADVISORY IDCVE-2026-56876⁠

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

CVSS SCORE

N/Amedium

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-2m3p-wcr6-c54v

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

24 hours ago

UPDATED

24 hours ago

ADVISORY ID

MINI-2v7g-v49f-f9gw

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

24 hours ago

UPDATED

24 hours ago

ADVISORY ID

MINI-4xvw-qjq7-wvf8

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

24 hours ago

UPDATED

24 hours ago

ADVISORY ID

MINI-7hw7-93rw-v4w3

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

24 hours ago

UPDATED

24 hours ago

ADVISORY ID

MINI-7r6j-x85p-wp82

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

24 hours ago

UPDATED

24 hours ago

ADVISORY ID

MINI-fc63-2hcr-rcc5

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

24 hours ago

UPDATED

24 hours ago

ADVISORY ID

MINI-fcj9-64fq-4vcr

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

24 hours ago

UPDATED

24 hours ago

ADVISORY ID

MINI-ggfh-g5j3-jfpc

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-j22v-523w-p3g7

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

24 hours ago

UPDATED

24 hours ago

ADVISORY ID

MINI-jch3-g2rm-fc98

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-m85h-rx2w-3hj4

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-p6h7-4xx5-8x86

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

1 day ago

UPDATED

1 day ago

ADVISORY ID

MINI-q6ww-hh5g-76mx

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY

minimos

CREATED

24 hours ago

UPDATED

24 hours ago

ADVISORY ID

MINI-r392-3vwq-84qc

EXPLOITABILITY SCORE

EXPLOITS FOUND

COMMON WEAKNESS ENUMERATION (CWE)-

RATING UNAVAILABLE FROM ADVISORY