decompress before 4.2.2 Path Traversal and Arbitrary File Write

Mitigation Strategies

To mitigate this vulnerability, ensure that the path containment check correctly enforces a path separator boundary when validating extraction paths.

Specifically, update the code to use a check like realParentPath.indexOf(realOutputPath + path.sep) !== 0 instead of realDestinationDir.indexOf(realOutputPath) !== 0.

Additionally, review and restrict unvalidated symlink creation in the package to prevent arbitrary file writes.

Consider upgrading decompress to a version later than 4.2.2 where this issue is fixed.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in decompress versions before 4.2.2 and involves an improper path containment check that allows directory traversal and arbitrary file write.

The issue is in the safeMakeDir function and extraction path validation, which use String.indexOf() to verify that the resolved path is within the intended output directory. However, this check is flawed because it does not enforce a path separator boundary, causing paths like "/tmp/app_config" to incorrectly pass as being inside "/tmp/app".

Because of this flaw, combined with unvalidated symbolic link creation in the package, an attacker can write arbitrary files to directories adjacent to the extraction target, bypassing intended security restrictions.

This vulnerability is a bypass of a previous fix (CVE-2020-12265) and the correct fix requires appending a path separator to the path check.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to write arbitrary files to directories outside the intended extraction directory.

Such arbitrary file writes can lead to unauthorized modification or creation of files, potentially enabling code execution, privilege escalation, or disruption of system or application functionality.

Because the attacker can bypass directory restrictions, this can compromise the integrity and security of the affected system.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to perform directory traversal and arbitrary file writes outside the intended extraction directory. This can lead to unauthorized modification or creation of files on the affected system.

Such unauthorized file writes could potentially result in data integrity issues or unauthorized access to sensitive information, which may impact compliance with standards like GDPR or HIPAA that require protection of data confidentiality and integrity.

However, the provided information does not explicitly describe direct impacts on compliance with these regulations.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a flawed path containment check in the decompress package, which can be exploited by crafted archives to perform directory traversal and arbitrary file writes outside the intended extraction directory.

To detect exploitation attempts or presence of this vulnerability on your system or network, you can:

• Monitor extraction operations using the decompress package for suspicious file writes outside the expected output directories.
• Check for unexpected or unauthorized symbolic links created during archive extraction.
• Audit logs for file creation or modification in directories adjacent to the intended extraction path.

Specific commands depend on your environment, but example commands include:

• Use find to detect recently created or modified files outside expected directories, e.g., `find /tmp -type f -newermt '2026-07-09'` to find files modified after the vulnerability publication date.
• Use ls or stat to inspect symbolic links in extraction directories, e.g., `find /tmp/app -type l -ls`.
• Monitor system logs or application logs for errors or warnings related to decompress package usage.

Until a patch is applied, avoid extracting untrusted archives with the decompress package to prevent exploitation.

Useful 0 Not Useful 0