CVE-2026-17524

Name of the Vulnerable Software and Affected Versions zip-lib versions prior to 1.1.0

Description An issue exists in the caching mechanism for path validation during the extraction process, allowing for Directory Traversal. This occurs because the security function isOutsideTargetFolder() only checks and caches the path status when the initial directory symlink is created during the first extraction, enabling an attacker to bypass security checks intended to prevent files from being written outside the target folder.

Recommendations Update zip-lib to version 1.1.0 or later.