Description
When extracting an untrusted archive with the default decompress(input, output) API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory.
Recommendation
Update the @xhmikosr/decompress package to the latest compatible version. Followings are version details:
Affected version(s): **<= 10.2.1 >= 11.0.0, <= 11.1.3** Patched version(s): **10.2.2 11.1.4**
References
Could your website be exposed too?
SmartScanner can check your website for @xhmikosr/decompress: Path traversal via symlink chain and gives you actionable findings to investigate.
Start a free scanRelated Issues
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
- NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node - CVE-2026-34156
- webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath - CVE-2026-76844
- moment vulnerable to Path Traversal via crafted non-string locale name - CVE-2026-17495
You might also like:
See something that needs correcting? Let us knowUpdated September 29, 2026