CVE-2026-17524: zip-lib Directory Traversal Vulnerability
TL;DR -
zip-libbefore 1.1.0 is vulnerable to directory traversal during extraction. - Apps that unpack untrusted ZIP files with vulnerable versions are at risk. - Upgrade to 1.1.0 or later and review extraction workflows immediately.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-17524 |
| CVSS | 7.5 High |
| Attack vector | Network in many real deployments, but exact NVD vector string was not provided |
| Privileges required | None stated in the available source material; defenders should assume attacker-controlled archive input is sufficient |
| Patch available | Yes, fixed in zip-lib 1.1.0 |
CVE-2026-17524 is a high-severity directory traversal issue in the Node.js package zip-lib. According to the NVD description, the vulnerability affects versions before 1.1.0 and stems from the library’s caching mechanism for path validation during archive extraction. The practical risk is straightforward: if your application extracts attacker-supplied ZIP content with a vulnerable version, files may be written outside the intended destination directory.
This is the kind of bug that often becomes more serious in production than the CVSS alone suggests. Archive extraction is commonly embedded in upload pipelines, import features, CI/CD tooling, backup restore flows, and document processing services. If the extracting process runs with broad filesystem permissions, a traversal bug can lead to overwritten configuration, dropped files in sensitive locations, or follow-on code execution depending on the host application design.
What Is This Vulnerability?
At a technical level, the flaw is a directory traversal weakness in how zip-lib validates extraction paths. The vulnerable behavior is tied to a security function named isOutsideTargetFolder, which is meant to stop archive entries from escaping the chosen extraction directory. Per the NVD description, that path status is checked and cached when an initial directory symlink is created during the first extraction step.
The problem is that caching a path safety decision too early is not equivalent to validating the final write target for every subsequent archive entry. If symlink state changes the effective path resolution after the first check, later entries may inherit a stale “safe” result even though they now resolve outside the target folder. In practice, that can let a crafted archive abuse symlink handling so the extraction routine writes files to unintended filesystem locations.
A key point for defenders is that this is not just a naive ../ traversal case. The issue is specifically about the interaction between extraction logic, symlink creation, and cached validation results. That makes ad hoc input filtering less reliable as a workaround, because the dangerous condition can arise from archive structure and path resolution behavior rather than a simple suspicious filename pattern alone.
Technical Notes
A simplified example of the risky workflow looks like this:
1. Archive creates a directory symlink within the extraction tree
2. zip-lib validates and caches that path as safe
3. Later archive entries are extracted under that cached path context
4. Effective resolved path points outside the target directory
5. Files are written outside the intended extraction root
Defenders should focus on any code path that extracts untrusted ZIP archives, especially where symlink entries are preserved or not explicitly blocked.
Who Is Affected?
The affected product is the npm package zip-lib from the fpsqdb/zip-lib project. Based on the NVD description, the affected versions are all versions before 1.1.0. The fixed version is therefore 1.1.0 or later. If your package.json, lockfile, container image, or bundled dependency tree includes zip-lib@0.x or any release lower than 1.1.0, you should treat that deployment as vulnerable until proven otherwise.
The direct impact falls on applications and services that use zip-lib to unpack ZIP archives from untrusted or semi-trusted sources. Common examples include customer upload portals, support bundle processors, data import tools, malware sandboxes, CI systems handling downloaded artifacts, and internal automation that unpacks archives received over email, APIs, or message queues. Even if zip-lib is not a direct dependency, transitive inclusion still matters if the extraction function is exposed in a reachable workflow.
The risk is lower, though not necessarily zero, when the application only extracts trusted archives generated entirely within a controlled environment. But many organizations overestimate how “trusted” archive sources really are. Shared storage, partner integrations, internal user uploads, and compromised upstream systems can all turn a nominally safe pipeline into an attacker-controlled one.
Technical Notes
Check direct and transitive package usage with npm:
npm ls zip-lib
If you use Yarn:
yarn why zip-lib
If you use pnpm:
pnpm why zip-lib
Look for version output below 1.1.0. If present anywhere in a production extraction path, that dependency should be queued for remediation.
CVSS Score Breakdown
The reported severity is CVSS 7.5 High, but the exact vector string was not provided in the available NVD tool output. Because the vector is not available in the supplied research note, it would be inaccurate to claim exact values for attack complexity, user interaction, privileges required, or impact sub-scores. Where the vector is unknown, defenders should avoid false precision and focus on the operational risk: untrusted ZIP extraction can become arbitrary filesystem write outside the intended directory boundary.
That said, a 7.5 score generally indicates a serious vulnerability with meaningful confidentiality, integrity, or availability impact under realistic conditions. In this case, the most obvious impact is integrity: an attacker may be able to overwrite files outside the extraction root. Depending on deployment details, that can also affect availability if key application files are corrupted, or confidentiality if traversal allows writes that alter logging, access control, or downstream processing in a way that exposes data.
For defenders, the important takeaway is not whether one submetric is L or H, but whether the vulnerable component is reachable in your environment. If your application accepts ZIP files from users, customers, third parties, or automated upstream feeds, the attack surface is materially exposed. If the extracting process runs with elevated filesystem permissions, the practical impact rises significantly.
Technical Notes
Because the exact NVD vector string was not provided, treat these fields as unknown from current source material:
Attack Complexity: Unknown from provided sources
User Interaction: Unknown from provided sources
Scope: Unknown from provided sources
Confidentiality/Integrity/Availability sub-scores: Unknown from provided sources
In the absence of a full vector, prioritize based on exposure: - Internet-facing upload or import path: high priority - Internal but user-accessible processing path: medium to high priority - Offline trusted-only batch use: lower priority, but still patch
Exploitation Status
Based on the supplied research, active exploitation in the wild is not confirmed. The CVE is not listed in CISA KEV (on_kev: false), which means there is currently no CISA confirmation of known exploitation. That does not mean exploitation is impossible or unlikely; it only means there is no public KEV confirmation from that source at this time.
There is, however, public technical discussion and a public patch commit. The available references include a GitHub issue and the fix commit 0c29b1e17050f2611f4f37e6aaa92a60b3cb89d5. A public patch diff often reduces the effort required for attackers or researchers to reconstruct a working proof of concept. From the provided sources, a standalone public exploit repository was not confirmed, so the most accurate statement is: technical details are public, but a discrete PoC repo is not confirmed from the available evidence.
This places the CVE in a common middle state: not known exploited in the wild, but sufficiently documented that defenders should assume reproduction is feasible. For internet-facing applications that process untrusted ZIP files, waiting for confirmed mass exploitation is not a sound risk strategy.
Technical Notes
Operational assessment from the supplied evidence:
Known exploited in the wild: Not confirmed
CISA KEV listed: No
Public issue/discussion: Yes
Public fix diff: Yes
Standalone public PoC repo: Not confirmed from provided sources
How to Detect It
Detection starts with inventory and usage mapping. First, identify where zip-lib is present and where ZIP extraction occurs in your application stack. Then determine whether those workflows handle untrusted archives and whether extraction destinations are sensitive. Without this context, log-only detection will miss the root exposure.
Second, look for signs of anomalous file writes around extraction events. Directory traversal through archive extraction often surfaces as unexpected files appearing outside the configured unpack directory, application errors caused by overwritten files, or suspicious symlink handling during upload/import operations. Because the exact runtime behavior depends on how the host application wraps zip-lib, defenders should monitor both application logs and filesystem activity.
Technical Notes
A practical detection approach is to search application logs for extraction-related events followed by path anomalies such as parent directory references or symlink mentions. Example grep patterns:
grep -RniE 'zip|extract|unpack|symlink|\.\./|outside target|target folder' /var/log /app/logs 2>/dev/null
If you ship Node.js logs to a SIEM, a generic search pattern could be:
("zip-lib" OR extract OR unzip OR archive) AND (symlink OR "../" OR "outside target" OR "target folder")
Example Splunk-style query for suspicious archive processing messages:
index=app_logs ("zip-lib" OR "extract" OR "archive")
| search ("../" OR "symlink" OR "outside target" OR "target folder")
| stats count by host, source, _time, message
For Linux systems, watch for writes outside the expected extraction root immediately after upload or import activity. If the app should only write under /srv/app/uploads/extracted, any archive-related writes elsewhere deserve review:
find /srv/app -type f -newermt "2026-07-28 00:00:00" ! -path "/srv/app/uploads/extracted/*" 2>/dev/null
If you have EDR or file integrity monitoring, create a rule to alert on the extracting service account writing to configuration directories, startup paths, or application code directories during archive processing windows.
Mitigation and Patching
The primary mitigation is to upgrade zip-lib to version 1.1.0 or later. The research note explicitly states that all versions before 1.1.0 are affected, making 1.1.0 the minimum fixed version. If zip-lib is a transitive dependency, you may need to update the parent package, apply a dependency override, or rebuild lockfiles and containers so the fixed version is actually pulled into runtime.
If immediate patching is not possible, reduce exposure by blocking untrusted archive extraction wherever feasible. Additional temporary controls include rejecting ZIP archives containing symlinks, extracting in a tightly sandboxed environment, using a low-privilege service account, and writing only into isolated temporary directories on filesystems with minimal permissions. These are compensating controls, not substitutes for the fixed package version.
Because this vulnerability involves path validation and symlink behavior, defenders should not rely solely on naive filename checks like rejecting ../. Archive traversal protections must evaluate the fully resolved destination path for each entry at extraction time. If you maintain custom extraction wrappers, verify that your code does not preserve symlinks or trust cached path decisions across archive entries.
Technical Notes
Upgrade directly with npm:
npm install zip-lib@^1.1.0
If you want to pin the minimum fixed version:
npm install zip-lib@1.1.0 --save
For Yarn:
yarn add zip-lib@^1.1.0
For pnpm:
pnpm add zip-lib@^1.1.0
If zip-lib is transitive, use an override where your package manager supports it. Example for npm package.json:
{
"overrides": {
"zip-lib": "1.1.0"
}
}
Example temporary mitigation pattern in application logic: reject archives that contain symlink entries before extraction. Exact implementation depends on your archive parser, but the principle is:
- enumerate entries
- fail closed on symlink entries
- resolve canonical output path for every entry
- ensure resolved path remains under the extraction root
After patching, rebuild and verify:
npm ls zip-lib
You should no longer see a version below 1.1.0 in the deployed dependency tree.
References
The authoritative public references available for this CVE point to the NVD entry, the project repository, a GitHub issue discussing the flaw, and the patch commit. These are the best sources for confirming affected version ranges, remediation guidance, and the nature of the underlying bug. Where the exact CVSS vector or exploit status is not explicitly stated in those sources, defenders should avoid assumptions and document the uncertainty in their internal advisory.
Because this is an npm package issue, also review your SCA tooling outputs, lockfiles, and SBOM records. In many environments, the most useful reference is not just the CVE record itself but the package inventory that tells you whether the vulnerable dependency is reachable in a real extraction workflow.
Technical Notes
- NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-17524
- Patch commit: https://github.com/fpsqdb/zip-lib/commit/0c29b1e17050f2611f4f37e6aaa92a60b3cb89d5
- GitHub issue: https://github.com/fpsqdb/zip-lib/issues/14
- Snyk reference: https://security.snyk.io/vuln/SNYK-JS-ZIPLIB-13834403
- Project repository: https://github.com/fpsqdb/zip-lib
If you need to brief stakeholders quickly, the defensible summary is: zip-lib before 1.1.0 is vulnerable to directory traversal during extraction; public technical details exist; in-the-wild exploitation is not confirmed from current sources; patch to 1.1.0 or later and review any untrusted ZIP extraction path immediately.
For further reading on related security topics, you may find these articles helpful: What is a Hypervisor? and How Does JWT Authentication Work?.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.