Zip-Lib Directory Traversal via Caching Mechanism

Executive Summary

CVE-2026-17524 is a Directory Traversal vulnerability in the npm package zip-lib affecting versions before 1.1.0. It occurs due to a flaw in the caching mechanism used for path validation during file extraction. Attackers can bypass security checks designed to prevent directory traversal, allowing access to files outside the intended folder. The vulnerability is triggered when extracting zip files containing directory symlinks pointing outside the target directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect systems using the zip-lib package version before 1.1.0. Check for unusual file writes or symlink creations in extraction directories. Use commands like 'npm list zip-lib' to verify installed versions. Monitor logs for unexpected file operations outside target folders.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to access sensitive system files or overwrite critical files like configuration or executable files. It enables arbitrary file writes outside the intended extraction folder, potentially leading to data breaches, system compromise, or denial of service. Exploitation does not require special conditions, privileges, or user interaction.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches exposing personal or health information, leading to regulatory penalties, loss of trust, and legal consequences for organizations failing to protect such data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade the zip-lib package to version 1.1.0 or higher using 'npm update zip-lib'. Avoid extracting untrusted zip files, especially those containing symlinks. Implement additional file system monitoring to detect suspicious extraction activities.

Useful 0 Not Useful 0