High [CVE-2026-56876] Arbitrary file write and information disclosure via symlink validation bypass
This high-severity Red Hat Linux advisory covers CVE-2026-56876 affecting Red Hat Enterprise Linux 10, Node HealthCheck Operator, Red Hat package: rh-podman-desktop.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory.
Depending on how extract-zip is used, an attacker could read or write to arbitrary files. This vulnerability allows a remote attacker to craft a malicious zip file containing symbolic links that point to locations outside the intended extraction directory.
This could enable an attacker to read or write to sensitive files, potentially leading to information disclosure or system compromise. A flaw was found in the extract-zip npm package.
Exploitation requires a user or automated process to extract a crafted ZIP archive. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
Weakness: CWE-22. Affected Red Hat products: Red Hat Enterprise Linux 10; Node HealthCheck Operator.
Affected products named by the advisory: Red Hat package: rh-podman-desktop.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
- rh-podman-desktop-0:1.1.2-1.el10_2
- RHSA-2026:57590
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Mitigation checklist
- No patch is available for extract-zip. The upstream maintainer is unresponsive (last commit 4+ years ago), and no fix is expected. Users should avoid using this package to extract untrusted ZIP archives. As a workaround, validate symlink targets manually before extraction, use an alternative library such as adm-zip or yauzl with proper path validation, or run extraction in a sandboxed environment (container, isolated filesystem).
Official advisory · high-confidence parse· fetched 13 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.