CVE-2026-19693 extract-zip arbitrary file write outside the destination directory via a symlink at the final path component
Attackers can write arbitrary files outside the destination directory by exploiting symlink handling in extract-zip, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-19693?
CVE-2026-19693 is a high-severity path traversal vulnerability in max-mapper extract-zip, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.
Which versions are affected by CVE-2026-19693?
2 open source packages ship an affected version, including extract-zip.
| Package | Affected | Fixed in |
|---|---|---|
extract-zip npm | All versions to 2.0.1 | None |
extract-zip npm | All versions to 2.0.1 | None |
How do I fix CVE-2026-19693?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-19693 being exploited?
There is no known exploitation of CVE-2026-19693 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-19693, GHSA-7pqw-9j4j-h8q3, MINI-228c-c4q8-7jg7, MINI-25cm-7j39-244h, MINI-3v9g-j92w-r22r, MINI-577w-8hfx-p5px and 13 more.