CVE-2026-17524: zip-lib Path Traversal Vulnerability

CVE-2026-17524 Overview

CVE-2026-17524 is a directory traversal vulnerability [CWE-22] affecting versions of the zip-lib npm package before 1.1.0. The flaw resides in the caching mechanism used for path validation during archive extraction. The isOutsideTargetFolder security function only validates and caches the path status when the initial directory symlink is created during the first extraction. Attackers can craft archives that bypass these checks and write files outside the intended target directory.

Critical Impact
Attackers can achieve arbitrary file write outside the extraction target directory by exploiting the cached path validation logic in zip-lib versions prior to 1.1.0.

Affected Products

zip-lib npm package versions before 1.1.0
Node.js applications that extract untrusted ZIP archives using zip-lib
Downstream libraries and tools bundling vulnerable zip-lib versions

Discovery Timeline

2026-07-28 - CVE-2026-17524 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-17524

Vulnerability Analysis

The vulnerability affects the archive extraction pipeline in zip-lib. During extraction, the library invokes isOutsideTargetFolder to determine whether an entry resolves to a location outside the extraction root. The function caches the outcome of this check keyed to a directory whose symlink status was evaluated only at first-encounter. Subsequent entries reusing the same path segment inherit the cached decision, even if the underlying filesystem state has changed during extraction.

An attacker who controls archive contents can order entries so that a benign directory is validated first and cached as safe. Later entries can then reference symbolic links or modified paths that resolve outside the target folder, but the cached decision short-circuits the safety check. The outcome is arbitrary file write outside the extraction directory, which can lead to code execution when overwriting startup scripts, configuration files, or Node.js modules.

Root Cause

The root cause is a stateful validation error. The isOutsideTargetFolder check treats path safety as immutable after first observation. It does not re-evaluate directories whose real path may change mid-extraction due to attacker-controlled symlink entries within the same archive.

Attack Vector

Exploitation requires a victim application to extract an attacker-supplied ZIP archive with zip-lib prior to 1.1.0. The attack is network-reachable in scenarios where user uploads, package installers, or CI pipelines process untrusted archives. No authentication or user interaction beyond triggering the extraction is required.

typescript

// Security patch in src/fs.ts - fix: Arbitrary File Write, close #14
     };
 }
 
-export async function ensureFolder(folder: string): Promise<void> {
+export async function ensureFolder(folder: string): Promise<{
+    isDirectory: boolean,
+    isSymbolicLink: boolean,
+    realpath?: string,
+}> {
     // stop at root
     if (folder === path.dirname(folder)) {
-        return Promise.resolve();
+        return Promise.resolve({
+            isDirectory: true,
+            isSymbolicLink: false
+        });
     }
     try {
-        await mkdir(folder);
+        const result = await mkdir(folder);
+        return result;
     } catch (error) {
         // ENOENT: a parent folder does not exist yet, continue
         // to create the parent folder and then try again.

Source: GitHub Commit 0c29b1e

The patch changes ensureFolder to return the symbolic link and real path status, enabling callers to re-evaluate whether a resolved path escapes the target folder rather than relying on cached results.

typescript

// Security patch in src/unzip.ts - tracking processed symlink folders
      * The name of the symlink file that has been processed.
      */
     readonly symlinkFileNames: string[];
+    /**
+     * The name of the symlink folder that has been processed.
+     */
+    readonly symlinkFolders: { folder: string, realpath: string }[];
     getFilePath(): string;
     /**
      * Whether the specified path is outside the target folder

Source: GitHub Commit 0c29b1e

Detection Methods for CVE-2026-17524

Indicators of Compromise

Files written outside the intended extraction directory following a zip-lib extraction operation.
Unexpected symbolic links appearing in extraction target folders during or after archive processing.
Modifications to Node.js modules, startup scripts, or configuration files coinciding with archive uploads.
Archive entries whose resolved paths contain .. sequences or point to symlinked directories.

Detection Strategies

Perform software composition analysis (SCA) on package.json and package-lock.json to flag zip-lib versions below 1.1.0.
Instrument extraction workflows to log real paths of each written entry and compare against the extraction root.
Alert on filesystem write events from Node.js processes targeting paths outside expected extraction directories.
Review archive contents server-side for symlink entries or path traversal sequences before extraction.

Monitoring Recommendations

Monitor process telemetry for node processes performing file writes outside application working directories.
Track dependency updates through CI/CD pipelines to ensure zip-lib is upgraded across all services.
Enable file integrity monitoring on sensitive directories such as ~/.ssh, /etc, and application configuration folders.

How to Mitigate CVE-2026-17524

Immediate Actions Required

Upgrade zip-lib to version 1.1.0 or later in all projects and rebuild dependent artifacts.
Audit all applications and services that accept user-supplied ZIP archives for vulnerable zip-lib versions.
Rotate credentials or secrets that may have been exposed if archives were extracted from untrusted sources.
Re-scan build pipelines and container images to confirm the patched version is deployed.

Patch Information

The fix is available in zip-lib version 1.1.0, released via GitHub Commit 0c29b1e. The patch modifies ensureFolder in src/fs.ts to return symbolic link metadata and introduces a symlinkFolders tracking array in src/unzip.ts so that path validation reflects the current filesystem state rather than a cached decision. Additional context is available in the GitHub Issue #14 discussion and the Snyk Vulnerability Report.

Workarounds

Extract untrusted archives inside disposable sandboxes such as containers or chroot environments with least-privilege filesystem access.
Reject archives containing symbolic link entries or path components with .. prior to invoking zip-lib.
Validate every written path against the resolved extraction root using fs.realpath after each entry is created.
Where upgrade is temporarily infeasible, switch to an alternative extraction library that enforces per-entry path validation.

bash

# Configuration example: upgrade zip-lib and verify installed version
npm install zip-lib@^1.1.0
npm ls zip-lib

# Optional: audit for known vulnerabilities across dependency tree
npm audit --production