CVE-2026-56876 is a path traversal vulnerability in max-mapper's extract-zip library. The issue arises because extract-zip fails to validate symlink targets during extraction, allowing symlinks with relative paths such as '../../../../etc/passwd' to be created outside the intended extraction directory. This improper limitation of pathname to a restricted directory (CWE-22) can lead to unauthorized file read or write operations depending on usage context. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality and integrity.

An attacker who can supply a crafted zip archive to extract-zip may cause the extraction process to create symbolic links pointing outside the intended directory. This can result in unauthorized reading or modification of arbitrary files on the system where extract-zip is run. The actual impact depends on how extract-zip is integrated and used, but it can lead to significant confidentiality and integrity violations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Users should monitor the vendor's communications for updates. Until a fix is available, avoid extracting untrusted zip archives with extract-zip or implement additional validation controls around extraction paths and symlink handling.