CVE-2026-56876 describes a path traversal vulnerability (CWE-22) in the max-mapper project's extract-zip utility. The issue arises because extract-zip does not validate symlink targets when extracting zip archives. Specifically, if a zip archive contains a symlink with a relative path such as '../../../../etc/passwd', extract-zip will extract the symlink without restricting its target to the extraction directory. This can allow an attacker to cause the extraction process to create or overwrite files outside the intended directory, potentially leading to arbitrary file read or write operations depending on usage context. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1 (Network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality and integrity impact, no availability impact). No patch or official fix information is currently available, and no known exploits in the wild have been reported.

Successful exploitation can allow an attacker to read or write arbitrary files on the system by leveraging symlinks extracted outside the intended directory. This can compromise confidentiality and integrity of the affected system or application data. The attack requires a malicious zip file and user interaction to trigger extraction. There is no indication of availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid extracting untrusted zip archives with extract-zip or implement additional validation to restrict symlink targets within the extraction directory. Monitor vendor communications for updates on official fixes.