How it started

On June 26, 2026, I got my first CVE. I was freaking happy. It was CVE-2026-56876.

Before that, I was looking around online when I found an article about Zip Slip on HackTricks.

I knew about normal path traversal, but then I saw the part about symlinks.

The problem happens when an extractor finds a symlink and simply creates it. It may think, “This is a symlink, so I will extract it and point it to its target.”

But if it does not check where the symlink points, the target can be outside the extraction folder. It could point to /etc/passwd or another important file. Depending on what the application does after extraction, this could allow an attacker to read or write files outside the intended folder.

I thought this bug was cool, so I asked myself why not find a similar one.

Choosing a target

I started researching possible targets. I wanted a project that looked inactive but still had a decent number of users. That way, there would be less attention on it while I tested it.

My choice was extract-zip.

Now I had a target and a goal. Time to work.

Finding the bug

I first searched the source code for mentions of symlinks. I found this block:

if (symlink) {
  const link = await getStream(readStream)
  debug('creating symlink', link, dest)
  await fs.symlink(link, dest)
} else {
  await pipeline(readStream, createWriteStream(dest, { mode: procMode }))
}

The important part was this line:

await fs.symlink(link, dest)

The code created the symlink, but it did not check where link was pointing. A ZIP file could contain a symlink with a relative target such as:

../../../../etc/passwd

After extraction, the symlink could point outside the extraction folder. The official CVE record describes the same problem and says that, depending on how the package is used, an attacker could read or write arbitrary files [1].

That was the bug.

Reporting

I first opened a GitHub Security Advisory for the project. During the process, I learned that the CVE request normally has to come from the maintainer or an authorized CVE Numbering Authority. The project looked inactive, so waiting for the maintainer did not seem like a good plan.

I went to CERT/CC through VINCE and reported the vulnerability there.

They accepted the report for coordination. On June 26, the official CVE record was published and credited me as an independent researcher [1].

That was the moment I got my first CVE.

Happy hacking.

References