CVE-2026-39246

Name of the Vulnerable Software and Affected Versions decompress versions prior to 4.2.2

Description An issue exists during archive extraction where the software allows arbitrary symlink creation. When processing symlink entries, the x.linkname field from the archive is passed directly to the fs.symlink() function without validation. While a check exists to prevent writing through symlinks, it only applies to file entries and not to the creation of symlinks. This allows an attacker to craft an archive containing symlink entries that point to sensitive files outside the extraction directory, potentially leading to information disclosure when the application reads the extracted contents.

Recommendations Update to version 4.2.2 or later.