CVE-2026-17524 describes a directory traversal vulnerability in zip-lib versions prior to 1.1.0. The vulnerability stems from an insufficient path validation mechanism during archive extraction. Specifically, the isOutsideTargetFolder function caches the path validation result only when the initial directory symlink is created during the first extraction. This caching allows an attacker to bypass security checks designed to prevent directory traversal, enabling extraction of files outside the intended target folder. This could lead to unauthorized file system modifications.

Successful exploitation allows an attacker to write files outside the intended extraction directory, potentially overwriting critical system or application files. This can lead to unauthorized file modifications, which may be leveraged for further attacks or system compromise. The CVSS 4.0 base score is 8.7 (high severity), indicating a significant impact with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from the zip-lib maintainers. Until a fix is available, avoid extracting untrusted archives with vulnerable versions of zip-lib or implement additional path validation controls externally.