High [CVE-2026-19693] Arbitrary file write via symlink in archive
This high-severity Red Hat Linux advisory covers CVE-2026-19693 affecting Multicluster Engine for Kubernetes, Node HealthCheck Operator, OpenShift Pipelines.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through the planted symlink and yields an arbitrary file write outside the destination directory.
By crafting a malicious zip archive containing a symbolic link (symlink) and a regular file with the same name, the attacker can bypass security checks. The extract-zip utility incorrectly validates only the parent directory, enabling the attacker to write files to arbitrary locations on the system.
Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Weakness: CWE-59.
Affected Red Hat products: Multicluster Engine for Kubernetes; Node HealthCheck Operator; OpenShift Pipelines; OpenShift Service Mesh 3; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Ansible Automation Platform 2; Red Hat Build of Podman Desktop; Red Hat Ceph Storage 4; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Fuse 7; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift GitOps.
Affected products named by the advisory: Red Hat package: grafana-pcp.
- 2.0.1
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Mitigation
The source record does not include mitigation steps. That is not a statement that no fix exists — read the vendor advisory below for the authoritative guidance.
Official advisory · high-confidence parse· fetched 2 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.