CVE-2026-39245

Name of the Vulnerable Software and Affected Versions decompress versions prior to 4.2.2

Description An improper path containment check allows directory traversal and arbitrary file write. The safeMakeDir() function and the extraction path validation use String.indexOf() to verify if the resolved path is within the output directory. This check is flawed because it does not enforce a path separator boundary, allowing paths that start with the same characters as the output directory but are actually adjacent to it to pass the validation. When combined with unvalidated symlink creation, an attacker can write arbitrary files to directories adjacent to the extraction target.

Recommendations Update to version 4.2.2 or later.