CVE-2026-56876: extract-zip unvalidated symlink path traversal

June 26, 2026 (updated August 12, 2026)

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like ‘../../../../etc/passwd’, extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

References

github.com/advisories/GHSA-jmr9-qjv8-65gv
github.com/ziad626/extract-zip-security-research/security/advisories/GHSA-x7jf-2287-qcpf
nvd.nist.gov/vuln/detail/CVE-2026-56876
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json
www.cve.org/CVERecord?id=CVE-2026-56876

Code Behaviors & Features

Detect and mitigate CVE-2026-56876 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →