High [CVE-2026-19693] Arbitrary file write via symlink in archive

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.

By crafting a malicious zip archive containing a symbolic link (symlink) and a regular file with the same name, the attacker can bypass security checks. The extract-zip utility incorrectly validates only the parent directory, enabling the attacker to write files to arbitrary locations on the system.

The flaw arises from insufficient validation of archive entries, allowing a remote attacker to write files to arbitrary locations on the system by providing a specially crafted zip archive. This requires user interaction to extract the malicious archive, but successful exploitation could lead to significant system integrity and availability compromise.

Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Weakness: CWE-59.

Affected products named by the advisory: Node HealthCheck Operator; OpenShift Pipelines; Red Hat Build of Podman Desktop; Red Hat Ceph Storage 4; and 6 more.