Bug 2493633 (CVE-2026-56876)

Summary: CVE-2026-56876 extract-zip: github.com/maxogden/extract-zip: extract-zip: Arbitrary file write and information disclosure via symlink validation bypass
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aazores, ataylor, bbrownin, bdettelb, cdrage, cmah, dbruscin, doconnor, eaguilar, ebaron, ehugonne, fdeutsch, gmalinko, gparvin, janstey, jkoehler, jolong, kaycoth, kshier, kvanderr, lchilton, lphiri, oramraz, pahickey, pdelbell, pjindal, rhaigner, rhel-process-autobot, rstepani, rushinde, sfeifer, smullick, stcannon, stirabos, teagle, thason, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in extract-zip. This vulnerability allows a remote attacker to craft a malicious zip file containing symbolic links that point to locations outside the intended extraction directory. When a user extracts this malicious archive, extract-zip fails to validate the symlink targets, leading to the creation of files in arbitrary locations on the system. This could enable an attacker to read or write to sensitive files, potentially leading to information disclosure or system compromise.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-06-26 18:01:30 UTC 
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.
Comment 2 errata-xmlrpc 2026-08-20 16:06:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:57590 https://access.redhat.com/errata/RHSA-2026:57590